AI Agent Identity Wiki

agent-standards-and-interoperability

15 min read

Agent Standards and Interoperability

Summary: The technical standards layer beneath national policy — runtime control, agent discovery, workload identity, and delegation protocols — and the recurring finding that discovery, identity, authorization, and accountability are distinct layers that are often conflated.

Sources: 2026-09-04-ai-agent-identity-news.md, 2026-09-07-ai-agent-identity-news.md, 2026-09-08-ai-agent-identity-news.md, 2026-09-09-ai-agent-identity-news.md, 2026-09-14-ai-agent-identity-news.md, 2026-09-16-ai-agent-identity-news.md, 2026-09-18-ai-agent-identity-news.md, 2026-09-21-ai-agent-identity-news.md, 2026-09-25-ai-agent-identity-news.md, 2026-09-28-ai-agent-identity-news.md, 2026-09-29-ai-agent-identity-news.md, 2026-10-06-ai-agent-identity-news.md, 2026-10-12-ai-agent-identity-news.md, 2026-10-16-ai-agent-identity-news.md, 2026-10-21-ai-agent-identity-news.md, 2026-10-26-ai-agent-identity-news.md, 2026-10-27-ai-agent-identity-news.md, 2026-10-28-ai-agent-identity-news.md, 2026-11-05-ai-agent-identity-news.md, 2026-11-06-ai-agent-identity-news.md, 2026-11-09-ai-agent-identity-news.md, 2026-11-11-ai-agent-identity-news.md

Last updated: 2026-11-11

National proposals such as estonia-ai-agent-id describe what should be true of an agent’s authority. The standards work below concerns how that is implemented and enforced across systems.

Separating the layers

The Cloud Security Alliance notes that the proposed IETF DAWN work addresses discovery of agents that are already identified, while identity and authorization are developing separately around WIMSE, OAuth delegation, and SPIFFE-style workload identifiers. Discovery, authentication, authorization, and accountability are related but distinct layers (source: 2026-09-07-ai-agent-identity-news.md, citing Cloud Security Alliance, published 2026-09-02).

This distinction is a useful lens on the rest of the wiki: proposals that sound contradictory sometimes address different layers.

Runtime control

OWASP Agent Control Standard (ACS) — 2026-09-01, a primary standards project — defines an open foundation for inspectable, traceable, instrumentable agents, and runtime enforcement of declarative safety policies through portable middleware hooks (source: 2026-09-07-ai-agent-identity-news.md, citing OWASP). It addresses the operational control layer that makes agent identity, access, actions, and behaviour observable and enforceable.

Existing identity building blocks

NIST points to OAuth 2.0 and SPIFFE as existing patterns for binding unique identifiers, credentials, and entitlements to a responsible party rather than sharing credentials (source: 2026-09-04-ai-agent-identity-news.md, citing NIST). See united-states-ai-agent-policy.

Interoperability as a national goal

Estonia’s Aruait project lists interoperability standards and an automated service-to-service pilot among its planned outputs, alongside an Identity 2.0 authority framework and a public AI-assistant trust registry (source: 2026-09-08-ai-agent-identity-news.md, citing RIA). This places a government project directly on the same layer as the standards work above.

2026-09-09: authorization envelopes and domain-specific delegation standards

A new Internet-Draft proposes the Agent Authorization Envelope (AAE): a structured, machine-evaluable container recording what an agent is mandated to do, which constraints apply, and how long authority remains valid — extending conventional OAuth/API-key authorization toward bounded, auditable autonomous action (source: 2026-09-09-ai-agent-identity-news.md, citing AAE Internet-Draft, 2026-09-06). This is an independent submission, not an adopted IETF standard, and sits alongside DAWN, WIMSE, and SPIFFE as candidate pieces of the identity/authorization layer.

Separately, EMVCo — the card-payments standards body — opened feedback (until 30 September 2026) on a draft framework for card-based agentic payments, whose central question is establishing that a consumer delegated authority to an agent, including for recurring purchases, cumulative budgets, and post-transaction actions (source: 2026-09-09-ai-agent-identity-news.md, citing EMVCo, 2026-09-01). This is the first domain-specific (payments) standards effort recorded in the wiki, distinct from the general-purpose identity/authorization work above. See agent-authorization-and-delegation for the delegation-model framing of both items.

2026-09-14: research on authorization envelopes and execution-time enforcement

The research page’s first Monday roundup adds academic grounding to this layer: a preprint proposing an “Agentic Principal Chain” authorization envelope that only narrows (never widens) across a multi-agent delegation chain, and a separate experimental study finding that a deterministic guard at the point of action — not exposure of authority evidence to the planner — is what actually enforces authorization correctly (source: 2026-09-14-ai-agent-identity-news.md, citing arXiv:2608.15888 and arXiv:2609.08472). See research for full summaries.

2026-09-16: NIST IR 8587 finalised, and an industry standards body under discussion

NIST and CISA finalised NIST IR 8587, an implementation guide for protecting identity tokens, access tokens, and assertions against forgery, theft, and misuse — covering identity-provider/authorization-server architecture, signing-key protection, token verification, lifecycle controls, revocation, interoperability, and continuous monitoring. It extends the OAuth 2.0/SPIFFE building blocks already noted above, but NIST explicitly states it is not a comprehensive treatment of AI-agent identity, pointing instead to separate NCCoE work on that topic (source: 2026-09-16-ai-agent-identity-news.md, citing NIST announcement and NIST IR 8587 publication record, 2026-09-15). This is a further illustration of the layer-separation theme above: hardening the token/credential layer does not by itself resolve agent identity, mandate, or per-action authority.

Separately, OpenAI, Anthropic, and Google DeepMind confirmed weeks of safety coordination and discussion of a possible industry standards body to set common safety-testing and auditing practices; OpenAI said it supports proposed independent verification requirements for leading frontier-model developers. The body is not yet formally established, and its authority, membership, and any government-oversight role are unresolved (source: 2026-09-16-ai-agent-identity-news.md, citing TechCrunch and Deutsche Welle, 2026-09-15/16). Unlike OWASP ACS, DAWN, WIMSE, AAE, and EMVCo above — each an open or multi-stakeholder technical standards effort — this would be an industry self-governance body formed by model developers themselves, closer in kind to Microsoft’s 2026-09-15 voluntary Code of Conduct than to a conventional standards-setting organisation. See united-states-ai-agent-policy and agent-authorization-and-delegation.

2026-09-18: ITU/World Bank focus group frames agent identity as a trust chain

The International Telecommunication Union, with World Bank Group participation, launched a Focus Group on Trust and Identity for Humans and Agentic AI (TIDA), tasked with developing terminology, use cases, identity models, credential formats, assurance levels, lifecycle controls, and mechanisms for government systems to verify agent authorization before it acts (source: 2026-09-18-ai-agent-identity-news.md, citing ITU, 2026-09-17). This is the first UN-system / multilateral standards effort recorded in the wiki, distinct in kind from the industry-led (OWASP, IETF, EMVCo) and national (NIST) work above, and from the industry self-governance body OpenAI/Anthropic/Google DeepMind discussed on 2026-09-16.

Substantively, the ITU frames an agent credential as evidence of a trust chain — person or organization, delegation, agent, action — rather than a legal identity belonging to the agent itself, and calls for delegation that is specific, time-bound, traceable, and revocable, with auditable per-action evidence. This is consistent with, rather than competing against, the “limited, auditable, revocable” delegation model already recorded for Estonia’s Identity 2.0, the AAE Internet-Draft, and the US bills — but adds a stated goal of mutual recognition across agencies and borders, which no source in the wiki has previously addressed. See agent-authorization-and-delegation.

2026-09-21: WIMSE’s identity-management draft advances to working-group status; a signed-receipt draft joins the stack

The WIMSE working-group draft “AI Identity Management System” (draft-ietf-wimse-aims-00) — first noted here on 2026-09-07 only as one candidate identity/authorization effort alongside DAWN, OAuth delegation, and SPIFFE — has matured into a working-group document. It composes existing mechanisms (unique workload identifiers, short-lived cryptographically bound credentials, OAuth-based delegated authorization, transaction tokens, cross-domain access, monitoring, policy, compliance) into a concrete Agent Identity Management System, rather than inventing a new protocol, and requires the represented user’s or system’s context to be preserved through to authorization decisions and audit trails (source: 2026-09-21-ai-agent-identity-news.md, citing IETF Datatracker, published 2026-09-15).

A separate individual Internet-Draft, “Agent Authority Transition Receipts for Agentic Systems” (no IETF endorsement or formal standing), proposes a signed, non-bearer receipt format binding one proposed operation to the represented principal, acting agent, action digest, policy/version, evaluated evidence, validity period, decision, and predecessor authority state, with fail-closed handling of missing or unverifiable evidence. It is designed to compose with OAuth, workload identity, attestation, and delegation protocols rather than replace them (source: 2026-09-21-ai-agent-identity-news.md, citing IETF Datatracker, published 2026-09-12, updated 2026-09-14).

Also newly surfaced: an academic review of 89 sources organizing agent authorization around a principal chain (human → operator/deployer → orchestrator agent → sub-agent → tool endpoint) and five control layers, naming the authorization decision at tool-invocation time as unresolved (source: 2026-09-21-ai-agent-identity-news.md, citing arXiv:2609.15906). See research for full summaries of all three items. No new Estonia or other-country development was found today.

2026-09-25: OECD launches a Working Group on Agentic AI in Government

The OECD Working Group on Agentic AI in Government brings together officials from member countries — including Estonia, Australia, Canada, Israel, Japan, Korea, Singapore, and the United Kingdom — to compare national experience and develop practical guidance on agentic AI in the public sector: foundations, guardrails, and public engagement. Writing in a personal capacity rather than as a formal OECD or member-country position, the authors name legal authority, human approval, durable logs, security controls, and reversible action as necessary safeguards for agents able to change official records or trigger state processes (source: 2026-09-25-ai-agent-identity-news.md, citing OECD.AI — Governing with agentic AI: when machines act on government’s behalf).

This is the second explicitly multilateral coordination effort recorded in the wiki, after the 2026-09-18 ITU/World Bank TIDA focus group. The two differ in kind: TIDA is developing technical identity models, credential formats, and assurance levels for cross-border mutual recognition, while the OECD group is framed around comparative government policy and public-sector guardrails — closer to a policy-coordination forum than a technical-standards body — though its member list overlaps with countries already tracked here. See estonia-ai-agent-id for Estonia’s specific participation, and australia-ai-agent-policy and united-kingdom-ai-agent-policy for two other named member countries. Whether the OECD group and ITU/World Bank TIDA coordinate with each other, or work independently, needs verification.

On 2026-09-29, Australia’s Digital Transformation Agency formally confirmed its own participation in the OECD working group with a primary national source, naming clear operating boundaries, meaningful human oversight, continuing human accountability, and effective control as its stated requirements for increasing agent autonomy (source: 2026-09-29-ai-agent-identity-news.md, citing DTA — Australia joins new OECD working group on agentic AI in government). This restates, with a primary Australian source, participation already known from the OECD’s own 2026-09-25 commentary rather than adding a new substantive claim; see australia-ai-agent-policy for full detail.

2026-09-28: a durable-identity registry and governance authority proposed for autonomous agents

A three-document individual-Internet-Draft series proposes a persistent, durable identity for autonomous agents — distinct from their replaceable names, credentials, keys, and accounts — built around an Agent Identity Registry System with permanent aid identifiers, hardware-backed anchors, assurance tiers, and competing registrars, plus a multi-stakeholder Agent Identity Authority governing the namespace, trust store, accreditation, dispute resolution, and registry succession (source: 2026-09-28-ai-agent-identity-news.md, citing Identity for Autonomous Agents and Robots, Agent Identity Registry System, and The Agent Identity Authority). Like the WIMSE AIMS and Agent Authority Transition Receipts drafts noted on 2026-09-21, these are individual submissions with no IETF endorsement or formal standing, and their status is explicitly preliminary. Unlike WIMSE AIMS, which treats an agent as a workload identified through existing OAuth/credential mechanisms, this series proposes a new, agent-specific, permanent-identifier registry and a governance body to run it — a materially different architectural bet.

Separately, a preprint proposes capability tokens cryptographically bound to both an agent and its issuer, carrying explicit scope, verifiable by a service as only-narrowing at each delegation step — drawing on the proposed OAuth Agent Authorization Profile and W3C DID/Verifiable Credential concepts (source: 2026-09-28-ai-agent-identity-news.md, citing arXiv:2609.30824). This is a concrete technical mechanism for the same only-narrows-never-widens principle already recorded for the Agentic Principal Chain model (2026-09-14) and the WIMSE/AAE/Transition-Receipts stack. See research for full detail on both items and two further papers from this week’s roundup.

Open questions (needs verification)

  • How a national trust registry (Estonia) would relate to, or interoperate with, workload-identity standards such as SPIFFE is not addressed in any source so far and needs verification.
  • Whether OWASP ACS, DAWN, and WIMSE have converging or competing identity models is not established in the current sources.
  • How the ITU/World Bank TIDA focus group’s cross-border mutual-recognition goal would relate to national schemes (Estonia’s Aruait, US NIST guidance) or to industry standards (OWASP ACS, DAWN, WIMSE, AAE) is not yet addressed and needs verification as the group’s work develops.
  • Whether the WIMSE AIMS draft and the Agent Authority Transition Receipts draft are meant to compose with each other, or address overlapping ground independently, is not established.
  • Whether the new OECD Working Group on Agentic AI in Government coordinates with the ITU/World Bank TIDA focus group, given overlapping member countries, is not established and needs verification.
  • This page now has two competing durable-identity proposals for agents at different maturity levels — the WIMSE AIMS working-group draft (workload-identity-based) and the new Agent Identity Registry System (permanent-identifier-based, 2026-09-28). Whether these are meant to compose, compete, or address different agent populations is not established.

2026-10-06: call for interoperable agent self-identification and delegation proof (UK)

The Loughborough vice-chancellor’s open letter (proposal only; names no specific standard) calls for interoperable standards through which agents identify themselves, prove whom they represent, and demonstrate expiring or revocable permissions (source: 2026-10-06-ai-agent-identity-news.md, citing Loughborough University). See united-kingdom-ai-agent-policy.

2026-10-12: Poppy (Personal Agent Protocol) draft

Sierra’s Draft 0.1 Personal Agent Protocol lets a business recognise a personal agent and its customer, with customer delegation and business-defined permitted actions; its operations extension separates proposing from confirming an action, requires standing permission to cover company/account/action/terms, bars company-generated text from counting as user approval, and uses operation identifiers against duplicate execution (source: 2026-10-12-ai-agent-identity-news.md, citing Sierra, spec, operations extension; primary, industry draft — not an adopted government or IETF standard). Limit noted by the report: confirmation records the agent’s assertion of approval, not independent proof the human approved. Whether Poppy composes with the IETF AAE/receipt drafts is not addressed — needs verification.

2026-10-16: Proof x401 rollout details

Proof published rollout details for x401: an agent identity wallet and HTTP challenge flow in which a service requests verified identity attributes and a signature on transaction terms, the person approves on their device, and the service verifies the credential, signature and terms and can retain the evidence. The protocol was first published in June and a first production implementation announced in September. It remains a vendor protocol in active development, not a government or IETF standard; legal-effect claims are the vendor’s (source: 2026-10-16-ai-agent-identity-news.md, citing Proof — x401 launch and x401 spec 0.1.0). It ties the represented person to approval of a specific action, complementing the delegation-envelope drafts above and agent-authorization-and-delegation.

2026-10-21: agent URI scheme, revision 04 (individual draft)

The agent URI Scheme and Verifiable Agent Identity, revision 04 (independent authors Yaswanth Narvaneni and Sai Purnima Ravi; IETF Datatracker, 20 October 2026; primary technical proposal). A stable agent URI maps to an identity document served over HTTPS and ties agent keys to a web origin or DID; profiles cover signed HTTP requests and short-lived instances using WIMSE workload credentials. It separates proof of key control from claims about the operator and from authorization to act — another instance of the identity/authorization layering described above. Individual Internet-Draft, not an adopted or endorsed IETF standard; publication hour unverified (source: 2026-10-21-ai-agent-identity-news.md).

2026-10-26: MTAC certificate draft and W3C strategy paper

  • draft-burls-mtac-01 (19 Oct, individual Internet-Draft, not an adopted IETF standard): Merkle Tree Agent Certificates identify one agent instance and record the sponsor a CA regards as accountable; optional scope and model/configuration declarations; audit cosigner. Explicitly a certificate neither authorizes actions nor records behavior; sponsor attribution is not a legal finding of liability; no implementation of this revision reported ((source: 2026-10-26-ai-agent-identity-news.md, citing IETF).
  • W3C strategy paper (announced 21 Oct, Strategy Team): maps gaps in agent identity profiles, delegated authority, consent and approval across web standards; proposes possible work, not an approved protocol or charter ((source: 2026-10-26-ai-agent-identity-news.md, citing W3C paper and announcement, primary).

Both reinforce the identity vs. authorization split. See research.

2026-10-27: IBM Agent Identity generally available

IBM announced general availability of Agent Identity (from September private preview): agent inventory with ownership and lifecycle state, on-behalf-of delegation, short-lived task-scoped tokens, runtime policy checks, audit trails; IBM Verify for identity/authorization and HashiCorp Vault for credentials of systems that cannot accept delegated tokens. A proprietary product, not a standard, and independently untested (source: 2026-10-27-ai-agent-identity-news.md, citing IBM). See 2026-10-27-ai-agent-identity-news.

2026-10-28: NIST tenets and BS ISO/IEC 27090:2026

NIST’s ten design tenets are a government design vision that existing standards cannot yet fully meet (source: 2026-10-28-ai-agent-identity-news.md, citing NIST). BSI announced BS ISO/IEC 27090:2026 on AI-system security: adjacent to, not a specification of, agent identity (source: same report, citing BSI).

2026-11-04 to 2026-11-09: WIMSE rev. 01, ITU-T focus group, CAC trust framework

  • WIMSE AI Identity Management System draft revision 01 (2 Nov) adds deprovisioning, session re-authorization and a per-trust-domain policy-system section; still an Informational draft (source: 2026-11-09-ai-agent-identity-news.md, citing draft -01). See research.
  • Zetrix/CAICT intend KYA pilot findings to feed ITU-T SG17’s Focus Group on Trust and Identity for Humans and Agentic AI — pre-standardisation input only (source: 2026-11-06-ai-agent-identity-news.md). See china-ai-agent-policy.
  • CAC’s 4 Nov initiative proposes open interoperability standards and a verifiable, traceable trust framework for agent discovery, negotiation and execution — a proposal, not a specification (source: 2026-11-05-ai-agent-identity-news.md).
  • Singapore (MDDI, 5 Nov) warns against incompatible sector-specific frameworks and plans regional standards work in 2027 (source: 2026-11-06-ai-agent-identity-news.md). See singapore-ai-agent-policy.

2026-11-11: Agent Name Service launches as a Linux Foundation project

  • The Linux Foundation announced (10 Nov) that Agent Name Service (ANS) has launched as a foundation project, formalising a June announcement of intent. ANS uses DNS and certificate-based signals for agent identity, verification and discovery; its seven-document specification covers naming and registration, versioning, DNS publication, log auditing, integrity monitoring and agent-to-agent authentication, under a technical steering committee. The issuer reports eleven supporting organisations and early interoperability work with AGNTCY and Agentic Resource Discovery (source: 2026-11-11-ai-agent-identity-news.md, citing Linux Foundation — Agent Name Service launch, via PR Newswire, primary issuer release, not independent reporting).
  • Status and layer: open, foundation-governed identity infrastructure rather than a proprietary product — but not a government scheme, statutory requirement or final IETF/ISO standard; adoption claims are untested. Consistent with this page’s recurring finding, identity/discovery does not by itself establish delegated permission or accountability (agent-authorization-and-delegation). See 2026-11-11-ai-agent-identity-news.

Graph View

Backlinks