AI Agent Authentication and Authorization (draft-klrc-aiagent-auth)

An IETF Internet-Draft that proposes a composition — not a new protocol — for authenticating and authorizing AI agents, by treating an agent as a workload. It assigns each agent exactly one WIMSE identifier (which MAY be a SPIFFE ID), binds that identifier cryptographically with short-lived X.509 or JWT credentials issued off attestation evidence, authenticates calls at the transport layer with mTLS or at the application layer with WIMSE Proof Tokens or HTTP Message Signatures, and carries delegation through OAuth 2.0 — token exchange, transaction tokens, cross-domain identity chaining, and CIBA when a human has to approve. It names static API keys as an antipattern for agent identity.