Skip to content

WIMSE Workload Credentials#

IETF 126 (Vienna) digest Program Core pick Vienna · 18–24 July 2026

Draft Slides Session recording Materials

Brian Campbell (Ping Identity), Joe Salowey (CyberArk), Arndt Schwenkschuster (Defakto Security), Yaron Sheffer (Intuit), Yaroslav Rosomakho (Zscaler).

  • Why: The credential layer of the workload-identity stack that OAuth-SPIFFE, the TLS hint, and the agent drafts all build on — and it was in Working Group Last Call at this meeting.
  • What: Defines the Workload Identity Token (WIT, a JWT) and Workload Identity Certificate (WIC, X.509) that bind a key to a workload's WIMSE identifier, usable across protocols; proof-of-possession mechanisms are deliberately out of scope and defined in companion documents.
  • How: Credential formats only — the separation of "what the credential is" from "how you prove possession" is the draft's main design contribution, letting the same credential work over mTLS, HTTP signatures, and proof tokens.
  • Where applicable: Any runtime in the WIMSE architecture, from basic single-service to multi-cloud multi-tenant. WG document past WGLC; the presentation indicated the road likely ends (i.e., publication) before the next meeting.