OAuth oauth.net

Workload Authorization Grant

datatracker.ietf.org/doc/draft-carleton-workload-authz-grant

The Workload Authorization Grant (WAG) is a profile of the JWT Authorization Grant that lets a workload, such as an AI agent, hosted on a platform get access tokens from a third party's authorization server. The platform signs a short-lived JWT naming one agent, and the agent presents it at the token endpoint of an authorization server that has been configured once to trust that platform. Each agent gets its own identity and audit trail, without an administrator registering each agent as an OAuth client and without agents sharing credentials.

WAG defines no new grant type or token format, instead building on RFC 7523. It covers workloads acting on their own behalf. WAG is an individual draft and an early exploration, not yet an OAuth Working Group item.

Workload Authorization Grant flow: the Platform is registered once at the Authorization Server, the Platform issues a WAG to the Agent, the Agent exchanges it for an access token, and calls the Resource Server

Terminology

Workload Authorization Grant (WAG)
The name of both the specification and the JWT it defines. The WAG is signed by the Platform, names one Agent in its sub claim, and is audienced to the Authorization Server's issuer identifier. It can include a scope claim, but the Authorization Server decides what access to grant.
Platform
The system that creates and hosts Agents and signs WAGs about them. The Platform is the issuer of the WAG. A multi-tenant provider is treated as a separate Platform for each customer, ideally with its own issuer identifier.
Agent
A workload running on the Platform, such as an AI agent, that presents a WAG to obtain access tokens. Its Agent Identifier, the sub of the WAG, is opaque, stable, and unique within the Platform.
Platform Registration
The one-time configuration at the Authorization Server that establishes trust in a Platform: its issuer identifier, its signing keys (a JWK Set, a JWK Set URL, or the jwks_uri from its metadata), an optional claim that identifies a tenant, and the local policy that maps the Platform's claims to permissions. It is not an OAuth client registration and issues no client ID.
Authorization Server
The OAuth authorization server that protects the Resource Server. It matches each WAG to exactly one Platform Registration, verifies it with that Platform's keys, applies its own policy, and issues an access token. It does not issue refresh tokens for this grant.
Resource Server
The API the Agent wants to call. It accepts access tokens issued by the Authorization Server.
JWT Authorization Grant (RFC 7523)
An OAuth mechanism for using a signed JWT as an authorization grant at a token endpoint. The Agent sends the WAG with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer in the assertion parameter, and should name the Resource Server with the resource parameter (RFC 8707). No client authentication is required.
Just-in-Time Agents
The Authorization Server accepts Agent Identifiers it has never seen before, as long as the WAG comes from a trusted Platform. New Agents need no action at the Authorization Server, so an Authorization Server can limit how many new Agents it accepts per Platform.


Implementations

Testing Tools

Related Specs

Discussion