WIMSE (Workload Identity in Multi-System Environments)

WIMSE (Workload Identity in Multi-System Environments) is an IETF working group and the family of specifications it produces for how software workloads identify and authenticate to each other across clouds, clusters, and organizations, starting from the architecture in draft-ietf-wimse-arch. As of early November 2026 none of the WIMSE documents is an RFC: the architecture, workload identifier, workload credentials, and mutual TLS documents are active working group drafts, the HTTP message signatures document has been submitted to the IESG, and the workload identity practices document is in IETF Last Call (ending 13 November 2026). See the WIMSE standards page for draft versions.

WIMSE exists because workload identity grew up in silos: SPIFFE inside clusters, cloud IAM federation between a runtime and its own provider, and bespoke service tokens everywhere else. The working group is standardizing the common pieces, including a workload identifier format, a workload credential, and proof-of-possession at the application layer through HTTP message signatures or mutual TLS, so a workload in one environment can present a credential another environment understands without a shared secret. For practitioners the near-term value is vocabulary and design patterns; the long-term value is replacing static API keys between services with credentials that are short-lived, attested, and bound to the caller.

See also: workload identity, SPIFFE, workload identity federation, transaction tokens, mTLS, workload identity 101, agent identity standards map 2026