SPIFFE (Secure Production Identity Framework for Everyone) SPIFFE

2 · Identify

SPIFFE (Secure Production Identity Framework for Everyone)
Category	Identify
Governed by	CNCF (SPIFFE is a graduated CNCF project); the AI-agent profile is governed separately as an IETF individual draft, not by the SPIFFE project itself
Status	Active, stable open-source specification set (SPIFFE/SPIRE); SPIFFE itself makes no agent-specific claims
Phase	stable
Implementation	multi-implementation
Adoption	observed — SPIFFE's own ecosystem page lists SPIRE, cert-manager, Consul, Dapr, Istio as open-source implementers and GCP, Teleport, Palo Alto Networks/Idira, Red Hat, Defakto, Cofide and Greymatter.io as commercial implementers — none of this is agent-specific adoption
Version	SPIFFE core specs (SPIFFE ID, X509-SVID, JWT-SVID, Workload API) are stable and versioned independently; the AI-agent profile is draft-klrc-aiagent-auth-03, published 2026-07-06
Specification	https://spiffe.io/docs/latest/spiffe-about/overview/
Found at	none
Last checked	2026-09-06

Identify SPIFFE (Secure Production Identity Framework for Everyone) is a CNCF-graduated set of open-source specifications for issuing short-lived, cryptographic identity documents (SVIDs — SPIFFE Verifiable Identity Documents, either X.509 or JWT) to software workloads via a local Workload API, so that services can mutually authenticate across dynamic, heterogeneous infrastructure without relying on network location ^[1]. It is included in this map's Identify layer because an active IETF individual draft proposes applying it — alongside WIMSE and OAuth 2.0 — to AI-agent authentication specifically ^[2].

Overview

It solves workload-to-workload mutual authentication at scale: instead of IP-based network policies, each workload instance attests to a SPIRE server (or another SPIFFE-compliant issuer) and receives a short-lived, automatically rotated identity bound to a spiffe://trust-domain/path name ^[1]. What it does not do is anything agent-specific by itself: the SPIFFE specification and its own documentation make no claims about AI agents, delegation from a human principal, or any of the semantics an autonomous-agent identity system would need beyond "this is workload X." That gap is what the separate draft-klrc-aiagent-auth draft (co-authored by engineers from Defakto, AWS, Zscaler, Ping Identity, OpenAI and Okta) attempts to address by describing how SPIFFE and WIMSE identities, combined with OAuth 2.0 token exchange, could carry an agent's identity and a delegation chain from its human or organizational principal — without SPIFFE itself defining any new protocol for this ^[2].

Current state: SPIFFE's core specifications (SPIFFE ID, X509-SVID, JWT-SVID, Workload API, Federation) are stable and have been for years; SPIFFE and its reference implementation SPIRE are both CNCF-graduated projects. The AI-agent application is at draft-klrc-aiagent-auth-03 (July 2026), an Informational individual draft under the IETF Network Working Group umbrella, not a SPIFFE-project deliverable ^[2].

Who implements it: SPIFFE's own ecosystem page lists SPIRE, cert-manager, Consul, Dapr and Istio as open-source implementers, and GCP, Teleport, Palo Alto Networks (Idira), Red Hat, Defakto, Cofide and Greymatter.io as commercial implementers of the general workload-identity spec ^[1] — none of this reflects AI-agent-specific deployment.

Disputed or unknown: whether SPIFFE will formally adopt an agent identity profile, versus this remaining an outside proposal layered on top of it, is unresolved. No production system was found in this pass actually issuing SPIFFE SVIDs to AI agents specifically (as opposed to conventional microservice workloads).

Discovery and probe

Local Workload API (a Unix domain socket, not a network-reachable endpoint) issues short-lived X.509-SVID or JWT-SVID identity documents to an attested workload · none

n/a (local IPC, not remotely probable) unix:///run/spire/sockets/agent.sock (SPIRE's default; not part of the SPIFFE spec itself)
parse:     Workload API FetchX509SVID/FetchJWTSVID response contains a SPIFFE ID (spiffe://trust-domain/path) and a short-lived SVID
on absent: No SPIFFE identity is available to the workload; it cannot present an SVID for mTLS or JWT-based authentication

Not probed live: not-http. SPIFFE identities are issued over a local socket, not published on the web.

History

2026-09-05 — seeded from Exa Agent research run
2026-09-06 — verified against spiffe.io's own overview/ecosystem page and draft-klrc-aiagent-auth-03; corrected framing to make clear SPIFFE itself is agent-agnostic and the agent application is an outside proposal

Instances

SPIRE · Recorded 2026-09-06 · service
Istio · Recorded 2026-09-06 · service
cert-manager · Recorded 2026-09-06 · service
Palo Alto Networks (Idira Secrets Manager) · Observed 2026-07-20 · business
HashiCorp Vault · Observed 2026-06-01 · service
Kagenti · Observed 2026-03-05 · service

Every instance with its source is listed on the instances page.

References

SPIFFE is a CNCF set of open-source specifications for issuing short-lived cryptographic workload identities (SVIDs) via a local Workload API; its own overview and ecosystem pages describe general workload identity for services, not AI agents specifically — https://spiffe.io/docs/latest/spiffe-about/overview/ VERIFIED
The IETF individual draft "AI Agent Authentication and Authorization" (draft-klrc-aiagent-auth-03, authored by engineers from Defakto, AWS, Zscaler, Ping Identity, OpenAI and Okta) proposes applying SPIFFE/WIMSE and OAuth 2.0 to AI-agent authentication, rather than defining new protocols — https://www.ietf.org/ietf-ftp/internet-drafts/draft-klrc-aiagent-auth-03.html (2026-07-06) VERIFIED

Disputed: SPIFFE itself is not an agent-specific standard — it is a general workload-identity framework. Its relevance to this map comes entirely from a separate, non-SPIFFE-governed IETF individual draft that proposes profiling SPIFFE (and WIMSE) for AI agents.

JSON · Markdown