Skip to main content
Agent Identity

IETF · 27 October 2026

WIMSE Applicability for AI Agents

draft-ni-wimse-ai-agent-identity-04

Y. Ni, C. P. Liu (Huawei), M. Richardson (Sandelman Software Works), B. Wang (CESI)

Individual draftDraft — expect changeIdentityAgent-specificField guide

WIMSE Applicability for AI Agents (draft-ni-wimse-ai-agent-identity-04) is Individual draft, 27 October 2026. States clearly why SPIFFE-style 'the binary is payment-api' is insufficient for 'this agent is Alice's tax bot'.

ShareLinkedInX

At a glance

Problem
A WIMSE workload identity names the agent process but not its owner. Agents that act for a human or organization need a credential that cryptographically binds agent identity to owner identity.
Identity / authn / authz
Identity binding (agent + owner). Authorization still needs OAuth/AAuth/policy on top.

Actors

  • Owner
  • Agent
  • Identity proxy
  • Identity server

01

The gap for agents

A WIMSE workload identity names the agent process but not its owner. draft-ni-wimse-ai-agent-identity-04 (27 October 2026, expires 30 April 2027), titled WIMSE Applicability for AI Agents, states why SPIFFE-style 'the binary is payment-api' is insufficient for 'this agent is Alice's tax bot' and proposes a dual-identity credential binding agent to owner.

Useful as a problem statement more than as a wire protocol. Not a WG item. Draft-04 adds B. Wang (CESI). The three issuance models are unchanged from draft-03.

02

Actors and trust boundaries

Owner keys are pre-provisioned as trust anchors. Draft-04 keeps the draft-03 issuance models: agent-mediated (owner-pre-signed), owner-mediated (gateway), and server-mediated (challenge-response). An identity proxy forwards the agent's credential request and attestation evidence. Authorization still needs OAuth/AAuth/policy on top.

03

Mechanics

Informational individual draft-04, Y. Ni and C. P. Liu (Huawei), M. Richardson (Sandelman Software Works), and B. Wang (CESI). Dual-identity credential format is a proposal, not a registered JWT typ. Read the three issuance models in the draft rather than implementing from this summary.

dual-identity credentialillustrative
Binds agent workload identity to owner identity. Not a registered JWT typ — illustrative name from the draft's problem framing.

04

Step-by-step flows

Flow 1

Bind agent to owner (conceptual)

  1. 1

    Owner authenticates to an identity server or gateway.

  2. 2

    Agent proves its workload identity.

  3. 3

    Issuer mints a credential that cryptographically binds both.

  4. 4

    Relying party verifies both names before treating the call as Alice's agent.

05

Identity vs authentication vs authorization

Identity binding (agent + owner). Authentication depends on the credential's proof. Authorization is out of scope.

06

How it composes

07

What bites agent implementers

  • Renewed individual draft

    Draft-04 (27 October 2026, expires 30 April 2027) is current. Still not a WG item. Confirm datatracker before citing a revision.

  • Not a registered token type

    Do not mint production typ values from this document.

08

Stability — what you can ship

draft-ni-wimse-ai-agent-identity-04, 27 October 2026, expires 30 April 2027. Individual informational. https://datatracker.ietf.org/doc/html/draft-ni-wimse-ai-agent-identity-04

Catalog claims (short form)

dual-identity credential
Binds agent workload identity to owner identity; format is a proposal, not a registered JWT typ.

Implementer notes

Draft-04 (27 October 2026, expires 30 April 2027) adds B. Wang (CESI) and does not change the three issuance models. Draft-02 had expired 1 September 2026; draft-03 renewed it on 1 October 2026. Still an informational individual draft, not a WG item. Useful as a problem statement more than as a wire protocol.

Related

Specs

Deployment patterns

Primary sources

  • HTML of draft-04https://datatracker.ietf.org/doc/html/draft-ni-wimse-ai-agent-identity-04