agenticweb.wiki

AI Agent Authentication and Authorization (AIMS) AIMS

Identify AI Agent Authentication and Authorization — informally called AIMS (Agent Identity Management System) by its authors — is an IETF Internet-Draft that proposes best practices for authenticating and authorizing AI agents by composing existing standards, principally the WIMSE architecture and the OAuth 2.0 family, rather than by defining any new wire protocol [1]. Its core thesis, as described by co-author Jeff Lombardo, is that an AI agent should be modeled as a workload: it needs an identifier, credentials that cryptographically bind to that identifier, a way to authenticate to other systems, and a way to request delegated authorization, all of which the identity community has already built for services and microservices [4].

Overview

It solves the "assembly gap" rather than a standards gap: instead of inventing new token formats or credential lifecycles for agents, it maps WIMSE identifiers (a superset of SPIFFE IDs) to identifiers, WIMSE Workload Identity Tokens / X.509 / SPIFFE JWT-SVIDs to credentials, mTLS and HTTP Message Signatures and WIMSE Proof Tokens to authentication, and OAuth 2.0 flows — authorization code for delegated user flows, client credentials for autonomous agents, token exchange and ID-JAG identity chaining for multi-domain workflows — to authorization, with the OpenID Foundation's Shared Signals Framework, CAEP and RISC left as the mechanism for observability and revocation [4]. It explicitly does not define any new protocol, does not pick a single policy/compliance standard (deliberately left deployment-specific), and — as of the version reviewed — does not close several hard problems: it has no defined way to revoke a subverted agent that still holds a validly attested credential, no settled per-hop scope-narrowing or chain-verification mechanism for multi-hop agent-to-agent delegation (at least one WIMSE list reviewer reported a confused-deputy escalation path under the current grant patterns), and does not resolve where cryptographic signing material should live given that AI workloads often run with broad sandbox privileges [3].

Current state, and the specific adoption question this record was created to check: the document is draft-klrc-aiagent-auth-03, an individual submission, last updated 2026-07-06, with no RFC stream and no intended RFC status set, expiring 2027-01-07 [1]. WIMSE WG chair Justin Richer opened a formal call for the working group to adopt it (co-author Pieter Kasselman, who also co-chairs WIMSE, recused himself from that process); the call closed 2026-08-24 with broad list support, most commenters treating the open technical gaps as post-adoption work rather than blockers [3]. However, checking the IETF datatracker's live WIMSE WG document list on 2026-09-07 — after that call closed — shows no draft-ietf-wimse-aiagent-auth or any other WG-adopted successor document; the WG's six active documents are unrelated WIMSE deliverables (architecture, workload proof tokens, HTTP signatures, identifiers, mutual TLS, workload credentials), and the WG's own "related drafts" list shows several other individual proposals on agent delegation instead. So: broad support for adoption exists on the list, but as of this check formal WG adoption has not yet been completed or reflected in the datatracker — this record should not claim WIMSE has adopted it.

Who implements it: no implementation was located; this is a framework/best-practices document, not a protocol with conformance software, so "implementation" here would mean deployments that follow its composition guidance, and none was independently verified in this pass.

Disputed or unknown: whether and when formal WG adoption completes; whether the final adopted scope keeps the AIMS name or the informal acronym; how the unresolved revocation and multi-hop delegation gaps get closed once (if) the WG owns the document; and how this composition-first approach will relate to competing agent-identity proposals also sitting in WIMSE's orbit (e.g. draft-asor-wimse-agent-delegation-chain, draft-reece-wimse-cross-org-delegation, draft-sweeney-wimse-credential-delegation), none of which this pass reviewed in depth.

Discovery and probe

none; this is a best-practices/architecture framework document, not a discoverable wire protocol with its own well-known path · none

GET none
parse:     not applicable — this record has no probeable wire signal; readers should instead probe the underlying components it composes (SPIFFE Workload API, WIMSE credential/token endpoints, OAuth 2.0 discovery metadata), each tracked as its own record
on absent: The draft is a best-practices framework, not a deployable protocol with its own presence signal; absence of adoption means only the individual draft-klrc-aiagent-auth-03 text exists, with no WG document, no registered media type, and no fixed discovery path to probe for

Not probed live: no-fixed-path. An IETF framework draft composing WIMSE, SPIFFE and OAuth flows; it defines no artefact of its own at an origin.

History

Instances

No instances recorded yet.

See also

References

  1. draft-klrc-aiagent-auth-03, "AI Agent Authentication and Authorization", is an Active Internet-Draft (individual submission, not a WG document), last updated 2026-07-06, expires 2027-01-07, authored by Pieter Kasselman, Jeff Lombardo (AWS), Yaroslav Rosomakho (Zscaler), Brian Campbell (Ping Identity), Nick Steele (OpenAI) and Aaron Parecki. Its abstract states it proposes best practices for AI agent authentication and authorization by leveraging existing standards — the WIMSE architecture and the OAuth 2.0 family — rather than defining new protocols, to provide a framework, identify gaps, and guide future standardization. — https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/ (2026-07-06) VERIFIED
  2. The IETF WIMSE working group document list (Active Internet-Drafts, 6 hits, checked 2026-09-07) contains draft-ietf-wimse-wpt, draft-ietf-wimse-http-signature, draft-ietf-wimse-arch, draft-ietf-wimse-identifier, draft-ietf-wimse-mutual-tls and draft-ietf-wimse-workload-creds. No draft-ietf-wimse-aiagent-auth (or any WG-adopted version of the AIMS draft) appears in that list or in the WG's "Related Internet-Drafts" section, which instead lists several other, separate individual drafts on agent delegation (e.g. draft-asor-wimse-agent-delegation-chain, draft-reece-wimse-cross-org-delegation, draft-sweeney-wimse-credential-delegation). — https://datatracker.ietf.org/wg/wimse/documents/ (2026-09-07) VERIFIED
  3. WIMSE WG chair Justin Richer opened a formal call for adoption of draft-klrc-aiagent-auth (referred to by the authors as AIMS) as a WIMSE working-group document, with responses due 2026-08-24; co-author Pieter Kasselman recused himself from chairing the process. List response was broad support for adoption, with most respondents treating remaining technical gaps (revocation of subverted-but-credentialed agents, multi-hop delegation scope narrowing and chain verification, a reported confused-deputy escalation path, and whether cryptographic signing material belongs inside AI workloads) as post-adoption work rather than blockers. — https://freenode.net/article/wimse-moves-to-adopt-ai-agent-auth-framework-draft (2026-08-24) REPORTED
  4. Co-author Jeff Lombardo's own account (IdPro blog) describes AIMS (Agent Identity Management System) as a layered framework composing existing standards — WIMSE identifiers (a superset of SPIFFE IDs) for identifiers, WIMSE Workload Identity Tokens / X.509 / SPIFFE JWT-SVIDs for credentials, mTLS / HTTP Message Signatures / WIMSE Proof Tokens for authentication, OAuth 2.0 flows (authorization code, client credentials, token exchange, ID-JAG identity chaining) for delegated authorization, and OpenID Shared Signals Framework / CAEP / RISC for observability and revocation — explicitly not defining any new wire protocol. — https://idpro.org/how-we-stopped-reinventing-and-started-composing-standards-for-agentic-identity/ (2026-07-29) REPORTED

Disputed: The draft is in a live WIMSE working-group adoption process: a formal call for adoption closed 2026-08-24 with broad list support for adopting it as a WG starting point, but as of 2026-09-07 the datatracker's WIMSE WG document list still shows no draft-ietf-wimse-aiagent-auth — only the individual draft-klrc-aiagent-auth-03 exists. Reviewers on the WIMSE list flagged unresolved gaps: no defined revocation path for a subverted-but-still-validly-credentialed agent, no per-hop scope narrowing or chain verification for multi-hop agent-to-agent delegation (at least one reviewer reported a confused-deputy escalation path), disagreement over modeling agent identity purely as workload identity, and concern that cryptographic signing material should not live inside AI workloads that often run with broad sandbox privileges.

JSON · Markdown