AI Agent Authentication and Authorization (IETF Internet-Draft)
Source: https://datatracker.ietf.org/doc/html/draft-klrc-aiagent-auth
Authors: Pieter Kasselman (Defakto Security), J. Lombardo (AWS), Y. Rosomakho (Zscaler), B. Campbell (Ping Identity), N. Steele (OpenAI), A. Parecki (Okta)
Published: 2026-07-06 (draft-klrc-aiagent-auth-03)
Intended Status: Informational
Expires: 2027-01-07
Overview
This IETF Internet-Draft proposes best practices for authentication and authorization of AI agent interactions. Rather than defining new protocols, it describes how existing, widely deployed standards — WIMSE (Workload Identity in Multi-System Environments), SPIFFE, OAuth 2.0, and OpenID SSF — can be applied and extended to establish a coherent agent identity and access control framework.
The document serves two goals: (1) consolidating prior art by showing how existing standards address core identity, authentication, authorization, and observability needs of agent-based systems, and (2) providing a foundation for identifying gaps and guiding future standardization.
Core Concept: Agent Identity Management System (AIMS)
The draft defines AIMS as a conceptual model for establishing, maintaining, and evaluating agent identity and permissions. Key components:
- Agent Identifiers: WIMSE identifiers (URI-based), optionally SPIFFE IDs (
spiffe://<trust-domain>/<path>) - Agent Credentials: Short-lived cryptographic credentials (X.509-SVID, JWT-SVID, WIT) bound to agent identifiers; static API keys explicitly called out as an antipattern
- Credential Provisioning: Dynamic runtime issuance with posture assessment (hardware attestation, TEE evidence, supply-chain provenance)
- Authentication: Transport-layer (mTLS) and application-layer (WIMSE Proof Tokens, HTTP Message Signatures)
- Authorization: OAuth 2.0 as delegation framework, with Client Credentials Grant for autonomous agents and Authorization Code Grant for user-delegated scenarios
- Risk Reduction: Transaction Tokens (Txn Tokens) for downscoped, transaction-bound credentials within microservice chains
- Observability: OpenID SSF for shared signals and remediation
Key Design Principles
1. Agents are workloads — they need identifiers, credentials, and authorization like any service 2. LLM must not access agent credentials — prevents prompt injection from leaking credentials 3. Short-lived credentials over static keys — reduces theft risk, enables autonomous rotation 4. Defense in depth — combine transport-layer (mTLS) with application-layer (WPT, HTTP signatures) 5. Posture assessment at provisioning time — hardware-backed evidence, TEE attestation, software integrity
Significance
This draft is one of the first comprehensive IETF-level efforts to define an authentication and authorization framework specifically for AI agents. It bridges the gap between AI agent architectures and decades of identity standards work. The involvement of authors from AWS, OpenAI, Okta, Zscaler, and Ping Identity signals serious industry convergence.
中文概要
IETF 互联网草案 draft-klrc-aiagent-auth-03 提出了 AI Agent 身份认证与授权的最佳实践框架。核心思路是将 Agent 视为工作负载 (workload)，复用 WIMSE、SPIFFE、OAuth 2.0 等现有标准而非重新发明协议。重点包括：短期凭证替代静态 API Key、LLM 不得接触凭证、姿态评估绑定凭证签发、交易令牌 (Txn Token) 降低微服务间令牌传递风险。作者来自 AWS、OpenAI、Okta、Zscaler、Ping Identity，标志着业界在 Agent 身份标准上的趋同。