What Is IETF AIMS? AI Agent Identification With SPIFFE and OAuth 2.0

AI agents are evolving quickly, and modern security standards haven’t kept pace. In lieu of new protocols and regulatory policies, deployers of agentic AI have a responsibility to manage their agents. IETF AIMS is a recommended identity and access management framework developed by cybersecurity experts, using existing standards and technologies.

In this article, we’ll define IETF AIMS along with relevant policies and standards, explore its eight essential components, and translate the draft’s key recommendations into clear best practices for implementation.

What Is IETF AIMS?

IETF AIMS is the conceptual model for agentic identity management proposed in a 2026 IETF Internet-Draft titled “AI Agent Authentication and Authorization.”

IETF (Internet Engineering Task Force) is a volunteer organization that establishes internet standards and protocols; AIMS (Agent Identity Management System) is the authors’ recommended framework for the establishment, maintenance and continuous evaluation of identity and permissions for AI agent workloads.

AIMS isn’t a protocol and doesn’t propose any new protocols or technologies. Instead, it recommends existing protocols:

1. Secure Production Identity Framework for Everyone (SPIFFE) identifier
2. Workload Identity in Multi-System Environments (WIMSE) identifier
3. OAuth 2.0 Authorization Framework

IETF AIMS is an individual Internet-Draft, not a formal or endorsed Internet Standard. Engineers at DeFakto, AWS, Ping Identity and Zscaler created the original draft; updated versions include contributions from experts at OpenAI and Okta. For the latest version and a complete version history, visit the IETF Draft Page for AI Agent Authentication and Authorization.

The original document was drafted in March 2026. If IETF decides to endorse the framework, it will create a Request for Comments (RFC) document.

What Is an AI Agent and How Does It Work?

An Artificial Intelligence (AI) Agent is a group of resources, applications and processes (collectively known as a workload) that iteratively interacts with a Large Language Model (LLM) and specific tools until it reaches a pre-defined endpoint. Either the LLM or the agent can establish that endpoint.

Another informal internet draft describes key use cases for AI agents:

• Deep search: Layered research processes involving multiple steps (search, verification and citations across goals and sub-goals) and resources (such as web, APIs, knowledge bases, files and computational tools)
• Hybrid AI: Collaborative task execution that prioritizes local operations on a small, low-latency model while reserving a larger cloud-based model for advanced capabilities
• Troubleshooting and automation: Artificial Intelligence/Machine Learning (AI/ML)-assisted operations to streamline failure detection and root-cause analysis and reduce operational burden

AI agents work by first obtaining permission from:

• The LLM
• The services, tools and resources it uses
• The user, if applicable (agents may also operate autonomously)

Permission consists of authentication to gain access (for which the agent needs an identifier) and authorization to access specific resources (for which the agent needs credentials). Once authorized, the AI agent, LLM and system resources exchange instructions; the system logs the agent’s activities to create traceable audit records.

Typically, this continues until the agent reaches its endpoint. However, if the LLM or tools detect suspicious activity, they may suspend or revoke access.

The Importance of AI Agent Authentication and Authorization

Without proper authentication and authorization, any AI agent could access any model, service or tool. Current systems for agentic authentication and authorization provide some protection, but AIMS addresses significant vulnerabilities:

• Static API keys, which are easily shared or stolen
• Credentials shared by other agents, which can’t confirm a specific agent identity and are prone to credential compromise
• User OAuth access tokens, which can’t be customized to specific transactions

A 2025 survey by the Cloud Security Alliance (CSA) found that 40% of organizations had AI agents in production, but only 18% were highly confident their systems could manage those agents’ identities and permissions.

That’s why the recommendations outlined in “AI Agent Authentication and Authorization” are so important. We need a better framework to protect the valuable systems and resources these agents access, and to stop them from going rogue.

Other Proposed Standards and Regulations for Agentic AI

Along with the IETF AIMS draft, other initiatives include:

1. National Cybersecurity Center of Excellence (NCCoE) Concept Paper “Accelerating the Adoption of Software and AI Agent Identity and Authorization:“ Released for comment in February 2026, this paper names many of the same authentication and authorization protocols as the AIMS draft. Comments closed April 2026.
2. Center for AI Standards and Innovation (CAISI) AI Agent Standards Initiative: Established in February 2026, this initiative proposes the development of official standards and guidelines, open-source protocols and research for technological advancements.
3. European Union (EU) AI Act: Effective August 2, 2026, high-risk AI systems operating in the EU (including those developed outside the EU) must demonstrate proper identity and authorization controls. Article 6 defines high-risk AI systems. One exception: Article 6(1) goes into effect August 2, 2027, one year after Article 6(2).
4. Colorado Automated Decision-Making Technology (ADMT) Bill: Signed into law May 14, 2026, Senate Bill 26-189 replaces Senate Bill 24-205, which was colloquially known as the Colorado AI Act. The new bill requires ADMT developers to produce clear technical documentation for deployers and consumer notifications for ADMT interactions from January 1, 2027.

Key Components of AIMS: The 8-Layer Model

The 8 components, or layers, of AIMS have evolved with each version. For example, Version 02 folded Attestation into Credential Provisioning, taking the number of components from nine down to eight.

1. Agent Identifiers

Agent identifiers are agent-specific codes that are stable for the lifetime of the workload identity. AIMS proposes two types of Uniform Resource Identifiers (URIs), sequences of characters that uniquely identify an abstract or physical resource.

• Workload Identity in Multi-System Environments identifier, known as WIMSE identifier or WIMSE-ID
• The Secure Production Identity Framework for Everyone identifier, known as SPIFFE identifier or SPIFFE-ID (a specific, operationally mature implementation of WIMSE-ID)

Info: Under AIMS, AI agents must be assigned one WIMSE URI, which is often a SPIFFE-ID.

2. Agent Credentials

Agent credentials cryptographically bind an agent identifier to specific attributes that govern its permissions.

• AIMS supports three credential types:
• Workload Identity Tokens (WIT), for WIMSE and SPIFFE
• 509, for WIMSE and SPIFFE
• JSON Web Tokens (JWT), for SPIFFE

Agentic AI credentials should be short-lived and must include explicit expiration dates. The AIMS draft calls long-lived, static API keys “an antipattern for agent identity.” Because of their short lifespan, credentials require constant oversight (more on that in layer 6).

3. Agent Attestation and Credential Provisioning

Attestation is the process of verifying that the agent accurately describes the way it behaves. In high-risk scenarios, AIMS recommends the combined attestation of an agent’s hardware, software and platform.

Credential provisioning is the way in which the system delivers agent credentials. The SPIFFE runtime environment (SPIRE) automates initial provisioning, rotation and revocation to govern secure access without manual operational burden.

4. Agent Authentication

Agent authentication includes the protocols and mechanisms an agent uses to prove its identity to LLMs, services, tools and resources. This includes:

• Transport Layer Authentication: Typically, mutually authenticated transport layer security (mTLS) with X.509 certificates
• Application Layer Authentication: WIMSE Proof Tokens (WPTs) and Hypertext Transfer Protocol (HTTP) Message Signatures

5. Agent Authorization

Agent authorization includes the protocols and systems LLMs and tools use to decide which resources an agent can access. AIMs recommends OAuth 2.0 for this purpose.

What Is OAuth?

OAuth 2.0 is a delegated authorization framework to grant limited resource access to an AI agent. First, a user issues approval for agent access to a specific resource on their behalf. Next, an authorization server verifies permissions and, if approved, grants conditional access via an access token.

OAuth for AI agents also manages revocation. When an agent completes its intended operations, its access should be revoked immediately.

AIMS intends to take this a step further, creating an additional security barrier between the workloads and the broader OAuth system. This includes combining access tokens with role-based, attribute-based or policy-based authorization details.

Additionally, AIMS recommends more secure access for specific transactions by exchanging access tokens for transaction tokens.

Transaction Tokens: Secondary Credentials for Specific Transactions

What happens when agents need to access legacy environments or proprietary resources that are incompatible with their credential type?

In this scenario, AIMS recommends a token exchange or credential exchange. The agent uses its primary credential or access token to request a transaction-specific credential; one even more limited in time and scope than typical short-lived agent credentials.

Success: This limits lateral movement: a transaction token is bound to one transaction and cannot be replayed as an access token or reused with modified transaction details. However, AIMS does allow an agent to exchange one for an access token when it needs to call another service.

6. Agent Monitoring, Observability and Remediation

Agent monitoring is the practice of tracking, recording and analyzing agent activity for audit-ready accounting and as-needed remediation. It’s inherently flexible: if observed behavior deviates from expected behavior or alters the system state, agent remediation allows the system to modify authorization decisions and revoke access.

Access logs must be comprehensive for audit readiness: traceable, time-stamped, detailed, tamper-evident and retained for a specified time period. Remediation must include observations and reasons for modifying or revoking access.

7. Agent Authentication and Authorization Policy

The agent authentication and authorization policy comprises the collective configuration and runtime parameters for:

• Agent identifiers
• Agent credentials
• Agent credential provisioning
• Agent authentication
• Agent authorization
• Agent monitoring, observability and remediation

Note: While AIMS doesn’t recommend specific models or document formats for this policy, it specifies clear versioning, ease of review and regular evaluation.

8. Agent Compliance

Agent compliance is the degree to which the agent adheres to the system defined in its agent authentication and authorization policy. It’s measured by analysis of observed behavior and recorded evidence relative to the outlined policy.

Since policies will vary widely, AIMS doesn’t establish specific compliance criteria. Instead, it emphasizes the importance of effective observability and audit records.

What IETF AIMS Really Means: Essential Takeaways to Implement Now

These are the most important conclusions from the complete history of IETF AIMS, including the latest drafts:

• AIMS isn’t about improving OAuth: The OAuth three-party framework (target service, user providing authorization and AI agent accessing the service on behalf of the user) works as-is. Instead, AIMS is about improving how the agent (the on-behalf-of party) authenticates itself.
• Static keys aren’t enough, but neither are basic access tokens: While AIMS warns against static keys, it also states that even short-lived access tokens allow misbehavior. Transaction tokens are the solution.
• SPIFFE is the best way, not the only way: Most summaries frame SPIFFE as the default AIMS solution, but AIMS describes several frameworks and pathways. While SPIFFE, SVIDs and SPIRE offer unique benefits, AIMS doesn’t promote just one method.
• Authentication and authorization are just two of the eight layers: The document’s official title, “AI Agent Authentication and Authorization,” misses many of the draft’s most essential takeaways: the importance of continuous trust, policy development and compliance for AI agents.

So, what should agentic AI developers and deployers do now, before new regulations make AIMS recommendations mandatory?

Stop Using Static API Keys

Static keys aren’t cryptographically bound, are easily compromised and survive too long to stay secure in the world of agentic AI. What’s “too long?” In the context of an AI agent, five minutes could be several lifetimes.

Agentic AI requires more than basic OAuth. Per the AIMS recommendation, it’s time to adopt transaction-specific access tokens and credentials for flawless observability and remediation.

Avoid OAuth’s Static-Secret Vulnerabilities with SPIFFE and Proxies

OAuth is the outer transport to third parties, but you must actively secure it to avoid built-in issues with static keys. To prevent the agent from ever holding a long-lived static secret, secure the inner layers with a short-lived SPIFFE Verifiable Identity Document (SVID) and, as applicable, a proxy to hold the OAuth token.

You Can Choose Various Identifiers, But SPIFFE, SVIDs and SPIRE Are Best

AIMS covers a variety of credential- and certificate-based authentication options. But SPIFFE issues short-lived credentials, including transaction-specific secondary credentials, for the most secure implementation.

SPIFFE isn’t mandatory, but it’s a highly secure yet flexible option. Use it to generate SVIDs and leverage its built-in runtime environment, SPIRE, for automated certificate issuance, rotation and revocation.

Maintain Traceable, Sealed Audit Logs

Under the guidance of AIMS, operators must support all remediation and revocation measures with comprehensive audit logs. Include agent identifiers, actions, context (including transaction tokens as applicable) and reason for changing access.

Note: These records aid detection, analysis and substantiation of any post-authorization decisions.

Implement Continuous Trust for Agents

Don’t underestimate the importance of Component 6: agent monitoring, observability and remediation.

One of the biggest takeaways from AIMS is that even short-lived credentials can allow agents to misbehave if left unmonitored. SPIRE automates and simplifies observability, including instant revocation to protect your resources.

Secure authentication is an important security control, as is authorization. But IETF AIMS emphasizes the necessity of a live, revocable trust relationship for effective agentic identity management.

How SecureW2 Supports Continuous Trust Infrastructure for AI Agents

Ultimately, deployers and users of agentic AI just want to know three things:

1. The agent is who it says it is
2. The agent is running where it’s supposed to run
3. The agent is using a short-lived agent- and/or transaction-specific credential that prevents misbehaving

The best way to secure that reality is with continuous policy enforcement for agents, and SecureW2 is committed to that future.

JoinNow Dynamic PKI is built for the robust certificate lifecycle automation AIMS outlines. Working alongside SPIRE, Dynamic PKI issues short-lived SVIDs that specify each agent’s unique scope, without vulnerable static keys.

The JoinNow Platform supports real-time remediation with Adaptive Defense, which continuously monitors live signals from your identity providers, Mobile Device Management (MDM) tools and security stack to detect anomalies and suspend or revoke as conditions change. There’s no need for manual IT intervention; webhooks and eventhooks automate enforcement.

Plus, organizations already using JoinNow Cloud RADIUS for 802.1X device authentication can extend the same certificate authority (CA) hierarchy to cover AI agent identities. This delivers a consistent, certificate-backed identity model for both human users and autonomous agents, all under a single trust anchor and policy engine.

Ready to modernize your approach to AI agent identity and access management? Schedule a demo to see how SecureW2 can help.