IETF · 27 August 2026

WIMSE Workload Proof Token

draft-ietf-wimse-wpt-02

B. Campbell, A. Schwenkschuster

WG draftDraft — expect changeAuthenticationAgent-specificField guide

Closest WIMSE analogue to DPoP, for workload-to-workload calls including agent-to-tool inside the trust domain.

At a glance

Problem: A WIT must not be sent as a bearer token. WPT is a signed JWT proving possession of the WIT's private key for a specific HTTP request.
Identity / authn / authz: Authentication / proof-of-possession at the application layer.

Actors

Calling workload
Called workload

The gap for agents

A WIT must not be sent as a bearer token. WPT is a signed JWT proving possession of the WIT's private key for a specific HTTP request — closest WIMSE analogue to DPoP, for workload-to-workload calls including agent-to-tool inside the trust domain.

Actors and trust boundaries

Caller proves the WIT key. Callee verifies WIT then WPT. A bearer token in the same Authorization header MUST NOT be used to authenticate the calling workload — that would reduce the request to its weakest credential. User/context tokens stay in other headers (Txn-Token) and can be bound via tth/oth.

Mechanics

draft-ietf-wimse-wpt-02, 27 August 2026, B. Campbell and A. Schwenkschuster. WPT in Authorization using the WPT HTTP authentication scheme. typ wpt+jwt (media type application/wpt+jwt). alg MUST match the WIT cnf.jwk alg. Claims include aud, WIT hash wth (base64url SHA-256 of the WIT), plus optional binding hashes for other tokens. Replaces earlier draft-ietf-wimse-s2s-protocol packaging. HTTP Message Signatures over WIT are a sibling mechanism, out of this document's scope.

Authorization: WPTfrom spec: Quoted HTTP authentication scheme carrying the proof JWT.
typ: wpt+jwt / wthfrom spec: Quoted: explicit type; wth is the hash of the WIT so the proof and credential cannot be mixed.

Step-by-step flows

Flow 1

WIT + WPT on an HTTP call

1
Caller sends Workload-Identity-Token and Authorization: WPT <jwt>.
2
Callee validates WIT (trust anchors, exp, cnf).
3
Callee checks WPT typ, alg match, signature with WIT's cnf key, wth matches this WIT, aud/time bindings.
4
Authorization policy uses workload identity from WIT plus any Txn-Token context — not a sibling Bearer token.

Identity vs authentication vs authorization

Authentication / proof-of-possession at the application layer. Identity is the WIT. Authorization is policy on that identity plus context tokens.

How it composes

WIMSE credentials
WIT is the credential WPT proves.
DPoP
Same job in OAuth-land; different headers and hashes.
HTTP Message Signatures
Alternative WIMSE PoP.
Transaction Tokens
Bind with tth so context cannot be swapped.

What bites agent implementers

Bearer + WPT on one request
The draft forbids using a bearer token to authenticate the caller when WPT is present. Honouring both undoes PoP.
Replay inside the WPT lifetime
Short-lived proofs; still capture-and-replay at intermediaries. Mitigations in the security considerations (audience, txn binding, short exp).

Stability — what you can ship

draft-ietf-wimse-wpt-02, 27 August 2026, expires 28 February 2027, standards-track WG. https://datatracker.ietf.org/doc/draft-ietf-wimse-wpt/

Catalog claims (short form)

WPT: Request-bound proof JWT. Replaces the idea of presenting WIT alone.

Implementer notes

Replaces earlier draft-ietf-wimse-s2s-protocol packaging. Sibling draft covers HTTP Message Signatures over WIT.

Relationship to others

Primary sources

Datatrackerhttps://datatracker.ietf.org/doc/draft-ietf-wimse-wpt/