Skip to content
Agent Identity

IETF · 28 February 2026 (expires 1 September 2026)

WIMSE applicability to Agentic AI (AI Agent Identity)

draft-ni-wimse-ai-agent-identity-02

Y. Ni (Huawei)

Individual draftDraft — expect changeIdentityAgent-specificField guide

States clearly why SPIFFE-style 'the binary is payment-api' is insufficient for 'this agent is Alice's tax bot'.

At a glance

Problem
A WIMSE workload identity names the agent process but not its owner. Agents that act for a human or organization need a credential that cryptographically binds agent identity to owner identity.
Identity / authn / authz
Identity binding (agent + owner). Authorization still needs OAuth/AAuth/policy on top.

Actors

  • Owner
  • Agent
  • Issuer / identity server

01

The gap for agents

A WIMSE workload identity names the agent process but not its owner. draft-ni-wimse-ai-agent-identity-02 (28 February 2026, expires 1 September 2026) states why SPIFFE-style 'the binary is payment-api' is insufficient for 'this agent is Alice's tax bot' and proposes a dual-identity credential binding agent to owner.

Useful as a problem statement more than as a wire protocol. Not a WG item. Check datatracker for expiry/renewal after 1 September 2026 — as of 15 September 2026 it may have expired.

02

Actors and trust boundaries

Owner keys are pre-provisioned as trust anchors. Issuance models in the draft include owner-mediated (gateway) and server-mediated (challenge-response). Authorization still needs OAuth/AAuth/policy on top.

03

Mechanics

Informational individual draft, Y. Ni (Huawei). Dual-identity credential format is a proposal, not a registered JWT typ. Three issuance models described; read the draft rather than implementing from this summary.

dual-identity credentialillustrative
Binds agent workload identity to owner identity. Not a registered JWT typ — illustrative name from the draft's problem framing.

04

Step-by-step flows

Flow 1

Bind agent to owner (conceptual)

  1. 1

    Owner authenticates to an identity server or gateway.

  2. 2

    Agent proves its workload identity.

  3. 3

    Issuer mints a credential that cryptographically binds both.

  4. 4

    Relying party verifies both names before treating the call as Alice's agent.

05

Identity vs authentication vs authorization

Identity binding (agent + owner). Authentication depends on the credential's proof. Authorization is out of scope.

06

How it composes

07

What bites agent implementers

  • Expired individual draft

    Expiry 1 September 2026. Confirm renewal before citing as current.

  • Not a registered token type

    Do not mint production typ values from this document.

08

Stability — what you can ship

draft-ni-wimse-ai-agent-identity-02, 28 February 2026, expires 1 September 2026, individual informational. https://datatracker.ietf.org/doc/html/draft-ni-wimse-ai-agent-identity-02

Catalog claims (short form)

dual-identity credential
Binds agent workload identity to owner identity; format is a proposal, not a registered JWT typ.

Implementer notes

Informational individual draft. Check datatracker for expiry/renewal after 1 September 2026. Not a WG item. Useful as problem statement more than as a wire protocol.

Relationship to others

Primary sources

  • HTML of draft-02https://datatracker.ietf.org/doc/html/draft-ni-wimse-ai-agent-identity-02