AI Agent Authentication and Authorization#

Nick Steele (OpenAI), Aaron Parecki (Okta), Jeff Lombardo (AWS), Brian Campbell (Ping Identity), Yaroslav Rosomakho (Zscaler), Pieter Kasselman (Defakto Security).

• Why: The strongest single framework document in the agent-identity land rush: deliberately anti-"invent a new AI protocol," it maps existing standards onto agent communications and surgically identifies what's missing. The author list (OpenAI, Okta, AWS) signals real platform intent.
• What: An informational draft ("AIMS") covering the full stack: exactly one WIMSE identifier per agent (may be a SPIFFE ID); primary credentials as WIMSE WIC/WIT or SPIFFE SVIDs, secondary via OAuth token exchange and Transaction Tokens; authentication at transport (mTLS with workload X.509) or application layer (WIMSE proof tokens, RFC 9421 HTTP signatures over WIT); OAuth for delegated authorization including human-in-the-loop (noting CIBA doesn't fit mid-execution pauses); SSF/CAEP for continuous posture signals; policy and compliance explicitly out of scope.
• How: Composition of existing specs with gaps named — the value is the map, not new mechanics.
• Where applicable: Agent-to-LLM/tool/service/agent interactions generally. Requesting chairs consider WG adoption as a work item; expect it to become the umbrella the other agent drafts hang from.