Skip to content
Agent Identity

IETF · 6 July 2026

AI Agent Authentication and Authorization

draft-klrc-aiagent-auth-03

P. Kasselman, J. Lombardo, Y. Rosomakho, B. Campbell, N. Steele, A. Parecki

Individual draftDraft — expect changeIdentity + Authn + AuthzAgent-specificField guide

Best current map of 'use this RFC for that agent problem'. Complementary to AAuth: AIMS says compose the old tools; AAuth says the old tools are insufficient for open-world HTTP clients.

At a glance

Problem
The industry is reinventing agent auth in incompatible silos. This draft does not define a new protocol. It maps existing IETF/OIDF/CNCF work onto agent needs and names the functional gaps.
Identity / authn / authz
A conceptual Agent Identity Management System covering identifiers, credentials, provisioning, authentication, authorization, observability, policy, and compliance. Agents are modeled as workloads that call LLMs and tools.

Actors

  • User or system
  • Agent
  • LLM
  • Tools / resources
  • AIMS components

01

The gap for agents

The industry is reinventing agent auth in incompatible silos. draft-klrc-aiagent-auth-03 (6 July 2026) does not define a new protocol. It maps existing IETF/OIDF/CNCF work onto agent needs and names the functional gaps. Read this before inventing an 'agent auth standard' — it will tell you which existing RFC you are duplicating.

Complementary to AAuth: AIMS says compose the old tools; AAuth says the old tools are insufficient for open-world HTTP clients. Both can be true in different deployments.

02

Actors and trust boundaries

Agents are modeled as workloads that call LLMs and tools. Users/systems are upstream principals. AIMS is a conceptual Agent Identity Management System covering identifiers, credentials, provisioning, authentication, authorization, observability, policy, and compliance — not a wire protocol with its own tokens.

03

Mechanics

Guidance, not endpoints: use WIMSE/SPIFFE for agent-as-workload authentication; use OAuth 2.0 for delegated or autonomous authorization (authorization code for user delegation, client credentials or JWT grants for autonomous agents); use identity chaining across domains; avoid API keys as the primary credential. Authors: P. Kasselman, J. Lombardo, Y. Rosomakho, B. Campbell, N. Steele, A. Parecki. Presented in WIMSE meetings (IETF 126).

04

Step-by-step flows

Flow 1

AIMS decision path (not a wire flow)

  1. 1

    Identify the principal: user, agent instance, workload, resource — separately.

  2. 2

    If the caller is a workload in your systems: WIMSE/SPIFFE (WIT+WPT or mTLS).

  3. 3

    If the call is on behalf of a user: OAuth 2.1 authorization code / CIBA / XAA, audience-restricted, preferably PoP.

  4. 4

    If crossing domains: identity chaining (8693+7523), not a copied access token.

  5. 5

    If inside a domain fan-out: transaction tokens for purpose. Observe and revoke via SSF/CAEP where sessions go stale.

05

Identity vs authentication vs authorization

A map across identity, authentication, and authorization. It does not mint tokens. It tells you which RFC's tokens to use for which agent problem.

06

How it composes

07

What bites agent implementers

  • Treating AIMS as a protocol

    There is no AIMS token type. If a vendor sells 'AIMS-compliant tokens', ask which RFC they mean.

  • API keys anyway

    The draft's point is to stop using API keys as the primary agent credential. If you still ship them, you skipped the BCP.

08

Stability — what you can ship

draft-klrc-aiagent-auth-03, 6 July 2026, expires 7 January 2027, individual informational. https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/. Use as a reading list, not as a wire spec.

Implementer notes

Individual informational draft. Presented in WIMSE meetings (IETF 126). Read this before inventing an 'agent auth standard'. It will tell you which existing RFC you are duplicating.

Relationship to others

Primary sources

  • Datatrackerhttps://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/
  • HTML of draft-03https://datatracker.ietf.org/doc/html/draft-klrc-aiagent-auth-03