{
 "acronym": "AIMS",
 "adoption": {
  "by": "The document's own authors and IdPro commentary describe it as broad list support (an \"A\" majority in the WIMSE WG adoption call closing 2026-08-24); the datatracker WIMSE WG document list, checked 2026-09-07, does not yet show a WG-adopted version (no draft-ietf-wimse-aiagent-auth exists)",
  "level": "claimed",
  "probe_run": null
 },
 "aliases": [
  "AIMS",
  "Agent Identity Management System",
  "AI Agent Authentication and Authorization"
 ],
 "analog": "none; closest classic-web analog is a service-account/workload-identity framework (e.g. cloud IAM roles) applied to a new class of caller",
 "collisions": [
  "AIP (Agent Identity Protocol, a different, unrelated DID-based individual draft already tracked as its own record)"
 ],
 "discovery": {
  "mechanism": "none; this is a best-practices/architecture framework document, not a discoverable wire protocol with its own well-known path",
  "path": "none"
 },
 "dispute": {
  "claims": [
   "Adoption is confirmed and imminent (author/IdPro framing, 2026-07-29 and 2026-08-24 sources)",
   "Adoption is a starting point only, not a blessing of every line, and the document still has open security gaps the WG must resolve (WIMSE chair Justin Richer and multiple list commenters, per the 2026-08-24 report)",
   "As of 2026-09-07 no WG-adopted document exists yet in the datatracker, so formal adoption has not been finalized"
  ],
  "summary": "The draft is in a live WIMSE working-group adoption process: a formal call for adoption closed 2026-08-24 with broad list support for adopting it as a WG starting point, but as of 2026-09-07 the datatracker's WIMSE WG document list still shows no draft-ietf-wimse-aiagent-auth — only the individual draft-klrc-aiagent-auth-03 exists. Reviewers on the WIMSE list flagged unresolved gaps: no defined revocation path for a subverted-but-still-validly-credentialed agent, no per-hop scope narrowing or chain verification for multi-hop agent-to-agent delegation (at least one reviewer reported a confused-deputy escalation path), disagreement over modeling agent identity purely as workload identity, and concern that cryptographic signing material should not live inside AI workloads that often run with broad sandbox privileges."
 },
 "evidence": [
  {
   "claim": "draft-klrc-aiagent-auth-03, \"AI Agent Authentication and Authorization\", is an Active Internet-Draft (individual submission, not a WG document), last updated 2026-07-06, expires 2027-01-07, authored by Pieter Kasselman, Jeff Lombardo (AWS), Yaroslav Rosomakho (Zscaler), Brian Campbell (Ping Identity), Nick Steele (OpenAI) and Aaron Parecki. Its abstract states it proposes best practices for AI agent authentication and authorization by leveraging existing standards — the WIMSE architecture and the OAuth 2.0 family — rather than defining new protocols, to provide a framework, identify gaps, and guide future standardization.",
   "date": "2026-07-06",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/"
  },
  {
   "claim": "The IETF WIMSE working group document list (Active Internet-Drafts, 6 hits, checked 2026-09-07) contains draft-ietf-wimse-wpt, draft-ietf-wimse-http-signature, draft-ietf-wimse-arch, draft-ietf-wimse-identifier, draft-ietf-wimse-mutual-tls and draft-ietf-wimse-workload-creds. No draft-ietf-wimse-aiagent-auth (or any WG-adopted version of the AIMS draft) appears in that list or in the WG's \"Related Internet-Drafts\" section, which instead lists several other, separate individual drafts on agent delegation (e.g. draft-asor-wimse-agent-delegation-chain, draft-reece-wimse-cross-org-delegation, draft-sweeney-wimse-credential-delegation).",
   "date": "2026-09-07",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/wg/wimse/documents/"
  },
  {
   "claim": "WIMSE WG chair Justin Richer opened a formal call for adoption of draft-klrc-aiagent-auth (referred to by the authors as AIMS) as a WIMSE working-group document, with responses due 2026-08-24; co-author Pieter Kasselman recused himself from chairing the process. List response was broad support for adoption, with most respondents treating remaining technical gaps (revocation of subverted-but-credentialed agents, multi-hop delegation scope narrowing and chain verification, a reported confused-deputy escalation path, and whether cryptographic signing material belongs inside AI workloads) as post-adoption work rather than blockers.",
   "date": "2026-08-24",
   "label": "REPORTED",
   "url": "https://freenode.net/article/wimse-moves-to-adopt-ai-agent-auth-framework-draft"
  },
  {
   "claim": "Co-author Jeff Lombardo's own account (IdPro blog) describes AIMS (Agent Identity Management System) as a layered framework composing existing standards — WIMSE identifiers (a superset of SPIFFE IDs) for identifiers, WIMSE Workload Identity Tokens / X.509 / SPIFFE JWT-SVIDs for credentials, mTLS / HTTP Message Signatures / WIMSE Proof Tokens for authentication, OAuth 2.0 flows (authorization code, client credentials, token exchange, ID-JAG identity chaining) for delegated authorization, and OpenID Shared Signals Framework / CAEP / RISC for observability and revocation — explicitly not defining any new wire protocol.",
   "date": "2026-07-29",
   "label": "REPORTED",
   "url": "https://idpro.org/how-we-stopped-reinventing-and-started-composing-standards-for-agentic-identity/"
  }
 ],
 "form": "document-format",
 "governance": "Individual IETF Internet-Draft under consideration by the IETF WIMSE working group (Applications and Real-Time Area); not yet a WG document as of 2026-09-07. Chairs of WIMSE: Justin Richer and Pieter Kasselman (a co-author of this draft, recused from chairing this specific adoption process).",
 "group": null,
 "history": [
  {
   "date": "2026-09-07",
   "note": "created from IETF datatracker (draft-klrc-aiagent-auth-03), WIMSE WG document list, and reporting on the 2026-08-24 WIMSE adoption call"
  }
 ],
 "id": "aiagent-auth",
 "implementation": "unknown",
 "last_verified": "2026-09-07",
 "name": "AI Agent Authentication and Authorization (AIMS)",
 "native_status": "Active Internet-Draft (individual submission), Internet-Draft, no RFC stream and no intended RFC status assigned; expires 2027-01-07",
 "origin": {
  "date": "2026-03",
  "org": "Pieter Kasselman (independent; WIMSE WG co-chair), Jeff Lombardo (AWS), Yaroslav Rosomakho (Zscaler), Brian Campbell (Ping Identity), Nick Steele (OpenAI), Aaron Parecki"
 },
 "part_of": null,
 "parties": [
  "agent-site",
  "agent-agent"
 ],
 "phase": "draft",
 "probe": {
  "method": "GET",
  "on_absent": "The draft is a best-practices framework, not a deployable protocol with its own presence signal; absence of adoption means only the individual draft-klrc-aiagent-auth-03 text exists, with no WG document, no registered media type, and no fixed discovery path to probe for",
  "parse": "not applicable — this record has no probeable wire signal; readers should instead probe the underlying components it composes (SPIFFE Workload API, WIMSE credential/token endpoints, OAuth 2.0 discovery metadata), each tracked as its own record",
  "path": "none"
 },
 "question": "Is there an IETF-endorsed way to authenticate and authorize an AI agent, and has the WIMSE working group actually taken this on?",
 "scope": "general",
 "spec_url": "https://datatracker.ietf.org/doc/draft-klrc-aiagent-auth/",
 "step": "identify",
 "summary_md": "AI Agent Authentication and Authorization — informally called AIMS (Agent Identity Management System) by its authors — is an IETF Internet-Draft that proposes best practices for authenticating and authorizing AI agents by composing existing standards, principally the WIMSE architecture and the OAuth 2.0 family, rather than by defining any new wire protocol [1]. Its core thesis, as described by co-author Jeff Lombardo, is that an AI agent should be modeled as a workload: it needs an identifier, credentials that cryptographically bind to that identifier, a way to authenticate to other systems, and a way to request delegated authorization, all of which the identity community has already built for services and microservices [4].\n\nIt solves the \"assembly gap\" rather than a standards gap: instead of inventing new token formats or credential lifecycles for agents, it maps WIMSE identifiers (a superset of SPIFFE IDs) to identifiers, WIMSE Workload Identity Tokens / X.509 / SPIFFE JWT-SVIDs to credentials, mTLS and HTTP Message Signatures and WIMSE Proof Tokens to authentication, and OAuth 2.0 flows — authorization code for delegated user flows, client credentials for autonomous agents, token exchange and ID-JAG identity chaining for multi-domain workflows — to authorization, with the OpenID Foundation's Shared Signals Framework, CAEP and RISC left as the mechanism for observability and revocation [4]. It explicitly does not define any new protocol, does not pick a single policy/compliance standard (deliberately left deployment-specific), and — as of the version reviewed — does not close several hard problems: it has no defined way to revoke a subverted agent that still holds a validly attested credential, no settled per-hop scope-narrowing or chain-verification mechanism for multi-hop agent-to-agent delegation (at least one WIMSE list reviewer reported a confused-deputy escalation path under the current grant patterns), and does not resolve where cryptographic signing material should live given that AI workloads often run with broad sandbox privileges [3].\n\nCurrent state, and the specific adoption question this record was created to check: the document is draft-klrc-aiagent-auth-03, an individual submission, last updated 2026-07-06, with no RFC stream and no intended RFC status set, expiring 2027-01-07 [1]. WIMSE WG chair Justin Richer opened a formal call for the working group to adopt it (co-author Pieter Kasselman, who also co-chairs WIMSE, recused himself from that process); the call closed 2026-08-24 with broad list support, most commenters treating the open technical gaps as post-adoption work rather than blockers [3]. However, checking the IETF datatracker's live WIMSE WG document list on 2026-09-07 — after that call closed — shows no draft-ietf-wimse-aiagent-auth or any other WG-adopted successor document; the WG's six active documents are unrelated WIMSE deliverables (architecture, workload proof tokens, HTTP signatures, identifiers, mutual TLS, workload credentials), and the WG's own \"related drafts\" list shows several other individual proposals on agent delegation instead. So: broad support for adoption exists on the list, but as of this check formal WG adoption has not yet been completed or reflected in the datatracker — this record should not claim WIMSE has adopted it.\n\nWho implements it: no implementation was located; this is a framework/best-practices document, not a protocol with conformance software, so \"implementation\" here would mean deployments that follow its composition guidance, and none was independently verified in this pass.\n\nDisputed or unknown: whether and when formal WG adoption completes; whether the final adopted scope keeps the AIMS name or the informal acronym; how the unresolved revocation and multi-hop delegation gaps get closed once (if) the WG owns the document; and how this composition-first approach will relate to competing agent-identity proposals also sitting in WIMSE's orbit (e.g. draft-asor-wimse-agent-delegation-chain, draft-reece-wimse-cross-org-delegation, draft-sweeney-wimse-credential-delegation), none of which this pass reviewed in depth.",
 "track": "ietf",
 "version": {
  "date": "2026-07-06",
  "label": "draft-klrc-aiagent-auth-03, individual submission, expires 2027-01-07"
 },
 "url": "https://agenticweb.wiki/protocols/aiagent-auth/",
 "category": "identify",
 "type": "protocol"
}