{
 "acronym": "WAG",
 "adoption": {
  "by": null,
  "level": "unmeasured",
  "probe_run": null
 },
 "aliases": [
  "WAG",
  "draft-carleton-workload-authz-grant",
  "Workload Authorization Grant"
 ],
 "analog": "A platform-issued service credential exchanged for an OAuth access token",
 "collisions": [
  "Workload Identity Token (WIMSE), which is a credential format rather than this grant"
 ],
 "discovery": {
  "mechanism": "OAuth token request carrying a platform-signed JWT. The draft defines no well-known file.",
  "path": null
 },
 "dispute": null,
 "evidence": [
  {
   "claim": "draft-carleton-workload-authz-grant-01 is an Informational individual Internet-Draft dated 22 September 2026 and expiring 26 March 2027. The header says Network Working Group. Authors include people from Anthropic, OpenAI, and Okta. A platform-signed JWT lets a workload obtain a third-party access token without a per-workload administrator step. The workload identifier is opaque and is never reassigned.",
   "date": "2026-09-22",
   "label": "VERIFIED",
   "url": "https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt"
  },
  {
   "claim": "Datatracker document page for draft-carleton-workload-authz-grant.",
   "date": "2026-09-22",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-carleton-workload-authz-grant/"
  }
 ],
 "form": "document-format",
 "governance": "IETF individual Internet-Draft (Informational). The header says Network Working Group. Not an OAuth working-group document.",
 "group": null,
 "history": [
  {
   "date": "2026-10-20",
   "note": "added from staged research 2026-10-20; header read from draft-carleton-workload-authz-grant-01"
  }
 ],
 "id": "workload-authz-grant",
 "implementation": "none-found",
 "last_verified": "2026-10-20",
 "name": "Workload Authorization Grant",
 "native_status": "Internet-Draft, Intended status: Informational; draft-carleton-workload-authz-grant-01 dated 2026-09-22, expires 2027-03-26",
 "origin": {
  "org": "Authors from Anthropic, OpenAI, and Okta (individual submission)",
  "date": "2026-09-22"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "draft",
 "probe": {
  "method": "n/a",
  "path": "n/a (OAuth token request; no fixed origin artifact)",
  "parse": "n/a. A platform-signed JWT is presented at a token endpoint. Nothing at a fixed path proves this grant.",
  "on_absent": "No public artifact is defined, so absence at an origin is expected."
 },
 "question": "How can a workload, such as an AI agent, obtain an access token from a third party's authorization server without a per-workload administrator step?",
 "scope": "general",
 "spec_url": "https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt",
 "step": "permit",
 "summary_md": "The Workload Authorization Grant (WAG) is an individual IETF Internet-Draft, `draft-carleton-workload-authz-grant-01`, dated 22 September 2026 and expiring 26 March 2027 [1]. The header says Informational and Network Working Group. Authors include people from Anthropic, OpenAI, and Okta [1]. It is not an OAuth working-group document.\n\nA workload, with an AI agent as the motivating case, obtains an access token from a third party's authorization server without a per-workload administrator step. The platform signs a JWT. The workload identifier is opaque and is never reassigned [1].\n\nWAG is a separate record from the OpenA2A Agent Authorization Protocol, the identity-continuation assertion, and the Agent-Delegation header. The datatracker entry for the draft is [2].",
 "track": "ietf",
 "version": {
  "label": "draft-carleton-workload-authz-grant-01",
  "date": "2026-09-22"
 },
 "watch": [
  {
   "type": "ietf",
   "doc": "draft-carleton-workload-authz-grant"
  }
 ],
 "use_cases": [
  "prove-agent-identity",
  "delegate-user-authority"
 ],
 "audience": [
  "platform",
  "agent-builder",
  "standards-body"
 ],
 "pairs_with": [
  "oauth-metadata-for-agents",
  "identity-assertion-authz-grant",
  "oauth-id-continuation",
  "oauth-agent-delegation",
  "opena2a-aap"
 ],
 "prerequisites": [],
 "freshness": "current"
}