Skip to content
Agent Identity

IETF · date: see source

Workload Identifier

draft-ietf-wimse-identifier-03

WG draftDraft — expect changeIdentityAgent-specificField guide

Gives the agent a stable name that is not a hostname and not an OAuth client_id.

At a glance

Problem
Need a canonical URI for a workload that can go into X.509 SANs and JWT sub values, interoperable with SPIFFE IDs.
Identity / authn / authz
Identifier syntax only. Credentials are a separate draft.

Actors

  • Issuer
  • Workload
  • Verifier

01

The gap for agents

Need a canonical URI for a workload that can go into X.509 SANs and JWT sub values, interoperable with SPIFFE IDs. Gives the agent a stable name that is not a hostname and not an OAuth client_id.

02

Actors and trust boundaries

The identifier is unique within a trust domain (the URI authority). Path semantics are deployment-specific. One identifier per credential — do not stuff both a user and a workload into a single URI.

03

Mechanics

draft-ietf-wimse-identifier-03 still current when fetched 15 September 2026. Absolute URI with a non-empty authority (trust domain). SPIFFE IDs are a conforming scheme. WIMSE also defines wimse://<trust-domain>/<path>.

wimse://trust.example.com/service/paymentillustrative
Illustrative identifier. Path semantics are deployment-specific. SPIFFE form is equally valid.

04

Step-by-step flows

Flow 1

Assign an identifier

  1. 1

    Pick a trust domain you control (DNS name or SPIFFE trust domain).

  2. 2

    Assign a path that names the workload (service, not instance, unless policy wants instances).

  3. 3

    Embed that one URI in WIT sub or WIC SAN. Issue credentials from the identity server.

05

Identity vs authentication vs authorization

Identifier syntax only. Credentials and proofs are separate drafts. Not authorization.

06

How it composes

07

What bites agent implementers

  • Two names in one credential

    The creds draft forbids encoding a second workload identifier in the same WIT/WIC. Use jti or other claims for instance correlation.

08

Stability — what you can ship

draft-ietf-wimse-identifier-03, WG document. HTML: https://datatracker.ietf.org/doc/html/draft-ietf-wimse-identifier

Catalog claims (short form)

wimse://trust.example.com/service/payment
Example identifier. Path semantics are deployment-specific.

Implementer notes

One identifier per credential. Do not stuff both a user and a workload into a single URI.

Relationship to others

Primary sources

  • HTML of draft-03https://datatracker.ietf.org/doc/html/draft-ietf-wimse-identifier