Workload Identity Metadata
Workload Identity Metadata is an agentic-web standard (endpoint) at step 2, Identify, governed by IETF WIMSE working group mailing list; its own status is "Internet-Draft, Intended Status: Standards Track; expires 19 April 2027" (draft). It answers: How can a workload's group, role, and entitlement attributes be conveyed to relying parties without encoding them in the workload identifier? Adoption is unmeasured, last verified 2026-10-19.
Identify This Internet-Draft specifies metadata attributes (group, role, entitlements) for workload identities, profiling existing JWT claims and defining an authenticated workload metadata endpoint usable with JWT- or X.509-based credentials. It defines a separation principle between identifier and metadata, including identifier uniqueness requirements. An optional JWT claim or X.509 extension points to the metadata endpoint. It applies to workloads generally, including AI agents, with agentic use cases discussed separately.
Discovery and probe
Optional JWT claim or X.509 certificate extension in the workload credential that identifies the workload metadata endpoint
NONE parse: on absent: Support cannot be observed externally; the endpoint location is carried inside workload credentials, so treat as unobserved.
History
- 2026-10-19 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00)
Instances
No instances recorded yet.
See also
References
- Internet-Draft draft-heigh-wimse-workload-identity-metadata-00 published 16 October 2026 by S. Heigh, J. Salowey (Palo Alto Networks) and Y. Rosomakho (Zscaler); specifies workload metadata attributes delivered in JWT-based credentials or via an authenticated metadata endpoint, separate from the workload identifier. — https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00 (2026-10-16) REPORTED