How does Workload Authorization Grant compare to other permit protocols?

Workload Authorization Grant (WAG) is one of 32 standards at step 3, Permit (What may the agent do here?). It pairs with OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization), Identity Assertion JWT Authorization Grant, Identity Continuation Assertion for OAuth 2.0 Token Exchange, Attenuated Delegation Profile for Automated Agents. Every standard at this step is listed at https://agenticweb.wiki/category/permit/.

Workload Authorization Grant WAG

3 · Permit

Workload Authorization Grant
Category	Permit
Governed by	IETF individual Internet-Draft (Informational). The header says Network Working Group. Not an OAuth working-group document.
Status	Internet-Draft, Intended status: Informational; draft-carleton-workload-authz-grant-01 dated 2026-09-22, expires 2027-03-26
Phase	draft
Implementation	none found
Adoption	unmeasured
Version	draft-carleton-workload-authz-grant-01 (2026-09-22)
Specification	https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt
Found at	OAuth token request carrying a platform-signed JWT. The draft defines no well-known file.
Acronym collisions	Workload Identity Token (WIMSE), which is a credential format rather than this grant
Last checked	2026-10-20
Freshness	current · checked 2026-10-20
Solves	Prove an agent's identity, Delegate a user's authority to an agent

Workload Authorization Grant (WAG) is an agentic-web standard (document format) at step 3, Permit, governed by IETF individual Internet-Draft (Informational). The header says Network Working Group. Not an OAuth working-group document; its own status is "Internet-Draft, Intended status: Informational; draft-carleton-workload-authz-grant-01 dated 2026-09-22, expires 2027-03-26" (draft). It answers: How can a workload, such as an AI agent, obtain an access token from a third party's authorization server without a per-workload administrator step? Adoption is unmeasured, last verified 2026-10-20.

Permit The Workload Authorization Grant (WAG) is an individual IETF Internet-Draft, draft-carleton-workload-authz-grant-01, dated 22 September 2026 and expiring 26 March 2027 ^[1]. The header says Informational and Network Working Group. Authors include people from Anthropic, OpenAI, and Okta ^[1]. It is not an OAuth working-group document.

Overview

A workload, with an AI agent as the motivating case, obtains an access token from a third party's authorization server without a per-workload administrator step. The platform signs a JWT. The workload identifier is opaque and is never reassigned ^[1].

WAG is a separate record from the OpenA2A Agent Authorization Protocol, the identity-continuation assertion, and the Agent-Delegation header. The datatracker entry for the draft is ^[2].

Discovery and probe

OAuth token request carrying a platform-signed JWT. The draft defines no well-known file.

n/a n/a (OAuth token request; no fixed origin artifact)
parse:     n/a. A platform-signed JWT is presented at a token endpoint. Nothing at a fixed path proves this grant.
on absent: No public artifact is defined, so absence at an origin is expected.

Not probed live: needs-credentials. The Workload Authorization Grant is a platform-signed JWT presented at a token endpoint; nothing is published at a fixed path.

History

2026-10-20 — added from staged research 2026-10-20; header read from draft-carleton-workload-authz-grant-01

Instances

No instances recorded yet.

References

draft-carleton-workload-authz-grant-01 is an Informational individual Internet-Draft dated 22 September 2026 and expiring 26 March 2027. The header says Network Working Group. Authors include people from Anthropic, OpenAI, and Okta. A platform-signed JWT lets a workload obtain a third-party access token without a per-workload administrator step. The workload identifier is opaque and is never reassigned. — https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt (2026-09-22) VERIFIED
Datatracker document page for draft-carleton-workload-authz-grant. — https://datatracker.ietf.org/doc/draft-carleton-workload-authz-grant/ (2026-09-22) VERIFIED

JSON · Markdown