AI Governance Engineer
GitHub

Workload identity

By Updated

The attributable identity a workload such as an agent carries across every hop, under which its actions are logged and its access is revoked, typically a short-lived, attested credential such as an SVID 1. It differs from channel authentication, which secures a single hop, such as a client talking to an MCP server.

Developed in
ch. 23, Channel authentication is not agent identity
ch. 04, Layer 04: Runtime Controls & Observability
Chapters
ch. 03, Values & Principles · ch. 04, The Stack · ch. 05, Patterns · ch. 23, AI Agents
Contrast with
NHI · SVID
In the open reference
Runtime safeguards for frontier AI · Agent runtime control profile
Source
1 numbered reference, listed below

Where it is used

6 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Patterns that use this term

2 pattern pages use the term, most mentions first.

  • CIMD

    Client ID Metadata Document: the mechanism by which an OAuth client identifies itself with a URL, used as its client ID, that points to its metadata document.

  • Guardian agent

    An AI agent whose job is to supervise, check or constrain other agents at runtime; Gartner predicts guardian-agent technologies will account for at least 10…

  • MCP

    Model Context Protocol: an open protocol for connecting AI applications to tools and data sources; its 2026 specification adds OAuth 2.1 resource-server…

  • Prompt injection

    An input that alters a model's behaviour or output in ways its designers did not intend.

  • Transaction token (Txn-Token)

    A short-lived, signed token, specified in an IETF OAuth working group draft, that carries user identity, workload identity and authorisation context through a…

Sources

  1. [1] SPIFFE overview (short-lived cryptographic identity documents called SVIDs, as X.509 certificates or JWTs; the Workload API issues and rotates them; SPIRE implementation). SPIFFE project. 2026. https://spiffe.io/docs/latest/spiffe-about/overview/ (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Workload identity. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/workload-identity. CC BY 4.0

BibTeX

@misc{aige2026workloadidentity,
  author  = {Jorge García Aibar},
  title   = {{Workload identity}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/workload-identity}
}