{
 "id": "wimse-workload-identity-metadata",
 "name": "Workload Identity Metadata",
 "acronym": "",
 "aliases": [
  "draft-heigh-wimse-workload-identity-metadata"
 ],
 "collisions": [],
 "step": "identify",
 "parties": [
  "agent-agent",
  "agent-site"
 ],
 "form": "endpoint",
 "track": "ietf",
 "scope": "general",
 "question": "How can a workload's group, role, and entitlement attributes be conveyed to relying parties without encoding them in the workload identifier?",
 "analog": "",
 "origin": {
  "org": "Palo Alto Networks / Zscaler",
  "date": "2026-10-16"
 },
 "governance": "IETF WIMSE working group mailing list; individual Internet-Draft",
 "native_status": "Internet-Draft, Intended Status: Standards Track; expires 19 April 2027",
 "phase": "draft",
 "implementation": "unknown",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "draft-heigh-wimse-workload-identity-metadata-00",
  "date": "2026-10-16"
 },
 "spec_url": "https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00",
 "discovery": {
  "mechanism": "Optional JWT claim or X.509 certificate extension in the workload credential that identifies the workload metadata endpoint",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": "Support cannot be observed externally; the endpoint location is carried inside workload credentials, so treat as unobserved."
 },
 "evidence": [
  {
   "claim": "Internet-Draft draft-heigh-wimse-workload-identity-metadata-00 published 16 October 2026 by S. Heigh, J. Salowey (Palo Alto Networks) and Y. Rosomakho (Zscaler); specifies workload metadata attributes delivered in JWT-based credentials or via an authenticated metadata endpoint, separate from the workload identifier.",
   "label": "REPORTED",
   "url": "https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00",
   "date": "2026-10-16"
  }
 ],
 "summary_md": "This Internet-Draft specifies metadata attributes (group, role, entitlements) for workload identities, profiling existing JWT claims and defining an authenticated workload metadata endpoint usable with JWT- or X.509-based credentials. It defines a separation principle between identifier and metadata, including identifier uniqueness requirements. An optional JWT claim or X.509 extension points to the metadata endpoint. It applies to workloads generally, including AI agents, with agentic use cases discussed separately.",
 "part_of": "wimse",
 "group": null,
 "candidate": true,
 "confidence": 0.8,
 "use_cases": [
  "prove-agent-identity",
  "audit-agent-actions",
  "delegate-user-authority"
 ],
 "audience": [
  "platform",
  "agent-builder",
  "standards-body"
 ],
 "pairs_with": [
  "wimse",
  "spiffe"
 ],
 "prerequisites": [
  "wimse"
 ],
 "dispute": null,
 "last_verified": "2026-10-19",
 "history": [
  {
   "date": "2026-10-19",
   "note": "auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00)"
  }
 ],
 "watch": [
  {
   "type": "page",
   "url": "https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00"
  }
 ],
 "freshness": "current",
 "url": "https://agenticweb.wiki/protocols/wimse-workload-identity-metadata/",
 "category": "identify",
 "type": "protocol"
}