IETF · 23 October 2026

Workload Identifier

draft-ietf-wimse-identifier-04

WG draftDraft — expect changeIdentityAgent-specificField guide

Workload Identifier (draft-ietf-wimse-identifier-04) is WG draft, 23 October 2026. Gives the agent a stable name that is not a hostname and not an OAuth client_id.

ShareLinkedIn X

At a glance

Problem: Need a canonical URI for a workload that can go into X.509 SANs and JWT sub values, interoperable with SPIFFE IDs.
Identity / authn / authz: Identifier syntax only. Credentials are a separate draft.

Actors

Issuer
Workload
Verifier

The gap for agents

Need a canonical URI for a workload that can go into X.509 SANs and JWT sub values, interoperable with SPIFFE IDs. Gives the agent a stable name that is not a hostname and not an OAuth client_id.

Actors and trust boundaries

The identifier is unique within a trust domain (the URI authority). Path semantics are deployment-specific. One identifier per credential — do not stuff both a user and a workload into a single URI.

Mechanics

draft-ietf-wimse-identifier-04 (23 October 2026, expires 26 April 2027). Changes since -03 are editorial, identity-mapping, and workload-uniqueness clarifications. Absolute URI with a non-empty authority (trust domain). SPIFFE IDs are a conforming scheme. WIMSE also defines wimse://<trust-domain>/<path>.

wimse://trust.example.com/service/paymentillustrative: Illustrative identifier. Path semantics are deployment-specific. SPIFFE form is equally valid.

Step-by-step flows

Flow 1

Assign an identifier

1
Pick a trust domain you control (DNS name or SPIFFE trust domain).
2
Assign a path that names the workload (service, not instance, unless policy wants instances).
3
Embed that one URI in WIT sub or WIC SAN. Issue credentials from the identity server.

Identity vs authentication vs authorization

Identifier syntax only. Credentials and proofs are separate drafts. Not authorization.

How it composes

WIMSE architecture
Architecture uses this identifier.
WIMSE credentials
WIT sub / WIC SAN.
SPIFFE / SPIRE
spiffe:// URIs conform.

What bites agent implementers

Two names in one credential
The creds draft forbids encoding a second workload identifier in the same WIT/WIC. Use jti or other claims for instance correlation.

Stability — what you can ship

draft-ietf-wimse-identifier-04, 23 October 2026, expires 26 April 2027, WG document. HTML: https://datatracker.ietf.org/doc/html/draft-ietf-wimse-identifier-04

Catalog claims (short form)

wimse://trust.example.com/service/payment: Example identifier. Path semantics are deployment-specific.

Implementer notes

One identifier per credential. Do not stuff both a user and a workload into a single URI.

Specs

Primary sources

HTML of draft-04https://datatracker.ietf.org/doc/html/draft-ietf-wimse-identifier-04