# Workload Authorization Grant WAG

[3 · Permit](/category/permit/)

| Workload Authorization Grant |
| --- |
| Category | [Permit](/category/permit/) |
| Governed by | IETF individual Internet-Draft (Informational). The header says Network Working Group. Not an OAuth working-group document. |
| Status | Internet-Draft, Intended status: Informational; draft-carleton-workload-authz-grant-01 dated 2026-09-22, expires 2027-03-26 |
| Phase | draft |
| Implementation | none found |
| Adoption | unmeasured |
| Version | draft-carleton-workload-authz-grant-01 (2026-09-22) |
| Specification | [https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt](https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt) |
| Found at | OAuth token request carrying a platform-signed JWT. The draft defines no well-known file. |
| Acronym collisions | Workload Identity Token (WIMSE), which is a credential format rather than this grant |
| Last checked | 2026-10-20 |
| Freshness | current · checked 2026-10-20 |
| Solves | Prove an agent's identity, Delegate a user's authority to an agent |

Workload Authorization Grant (WAG) is an agentic-web standard (document format) at step 3, Permit, governed by IETF individual Internet-Draft (Informational). The header says Network Working Group. Not an OAuth working-group document; its own status is "Internet-Draft, Intended status: Informational; draft-carleton-workload-authz-grant-01 dated 2026-09-22, expires 2027-03-26" (draft). It answers: How can a workload, such as an AI agent, obtain an access token from a third party's authorization server without a per-workload administrator step? Adoption is unmeasured, last verified 2026-10-20.

[Permit](/category/permit/) The Workload Authorization Grant (WAG) is an individual IETF Internet-Draft, draft-carleton-workload-authz-grant-01, dated 22 September 2026 and expiring 26 March 2027 [[1]](#ref-1). The header says Informational and Network Working Group. Authors include people from Anthropic, OpenAI, and Okta [[1]](#ref-1). It is not an OAuth working-group document.

## Overview
A workload, with an AI agent as the motivating case, obtains an access token from a third party's authorization server without a per-workload administrator step. The platform signs a JWT. The workload identifier is opaque and is never reassigned [[1]](#ref-1).

WAG is a separate record from the OpenA2A Agent Authorization Protocol, the identity-continuation assertion, and the Agent-Delegation header. The datatracker entry for the draft is [[2]](#ref-2).

## Discovery and probe

OAuth token request carrying a platform-signed JWT. The draft defines no well-known file.

```
n/a n/a (OAuth token request; no fixed origin artifact)
parse:     n/a. A platform-signed JWT is presented at a token endpoint. Nothing at a fixed path proves this grant.
on absent: No public artifact is defined, so absence at an origin is expected.
```

Not probed live: needs-credentials. The Workload Authorization Grant is a platform-signed JWT presented at a token endpoint; nothing is published at a fixed path.

## History
- 2026-10-20 — added from staged research 2026-10-20; header read from draft-carleton-workload-authz-grant-01

## Instances

No instances recorded yet.

## See also

- Not to be confused with: Workload Identity Token (WIMSE), which is a credential format rather than this grant

## References

- draft-carleton-workload-authz-grant-01 is an Informational individual Internet-Draft dated 22 September 2026 and expiring 26 March 2027. The header says Network Working Group. Authors include people from Anthropic, OpenAI, and Okta. A platform-signed JWT lets a workload obtain a third-party access token without a per-workload administrator step. The workload identifier is opaque and is never reassigned. — [https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt](https://www.ietf.org/archive/id/draft-carleton-workload-authz-grant-01.txt) (2026-09-22) VERIFIED
- Datatracker document page for draft-carleton-workload-authz-grant. — [https://datatracker.ietf.org/doc/draft-carleton-workload-authz-grant/](https://datatracker.ietf.org/doc/draft-carleton-workload-authz-grant/) (2026-09-22) VERIFIED

[JSON](/data/protocols/workload-authz-grant.json) · [Markdown](/protocols/workload-authz-grant/index.md)