Workload Identity

2 Articles

The Runtime Mints the Identity. That Does Not Make It the Authority.

The Agent Identity Market Will Be Decided at the Binding Layer

Series Agent Control Points Part 2 of 3

Agent runtimes naturally create the first trustworthy evidence about an instance, which gives them the default position in agent identity. Runtime proof and enterprise binding are still separate jobs. In heterogeneous enterprises, a binding layer can map evidence from many runtimes into durable Agent and Agent Deployment records and supply that governed context to credential issuers and resources. It is a real control plane only if the enterprise state survives changing runtimes. In the open world, model-provider harnesses are better positioned to integrate the stack because they hold the user relationship and execution loop. Distribution determines the default. Standard seams determine whether it can be challenged. Even a won binding layer answers whose agent is running, not whether its current work remains approved. That requires the third control point, an approved-task record with its own lifecycle.

Agentic Identity Workload Identity Standards Interoperability Federation OAuth

Client Instances Are Actors, Not New Clients

Client instances are not new clients. They are actors. With the Actor Profile and the act chain already in place, and an instance_issuers field that fits any client registration channel (static, Dynamic Client Registration, or CIMD), treating instances as first-class actors needs no new grant type, no new client type, and no new claim. It needs a profile that ties them together.

OAuth Standards Delegation Client Instance Workload Identity Agentic Identity JWT CIMD