SPIFFE
In short:SPIFFE is an open standard for giving software workloads a cryptographic identity without passwords or keys in config. Each workload receives a short-lived SVID, as an X.509 certificate or JWT. Agents running as workloads can use it to prove who they are to other services.
What is it?
SPIFFE defines an identity format, the SPIFFE ID, and a document that carries it, the SVID. A workload API hands SVIDs to processes after attesting them.
SVIDs rotate automatically and expire quickly.
Why do agents need it?
An agent that runs as a service needs to authenticate to APIs. SPIFFE replaces a stored secret with an identity issued at run time.
It works across clouds, which suits agents that move between environments.
Which scored platforms name it?
Other scored platforms: not found in public material read on 3 November 2026.
Other standards
- OAuth 2.1
- MCP authorization
- Enterprise-Managed Authorization (Cross App Access, ID-JAG)
- Client ID Metadata Documents (CIMD)
- DPoP and mTLS
- CIBA (human approval)
- OAuth token exchange (RFC 8693)
Sources
- [ae-home] Aembit home. https://aembit.io/. Read .
- [ds-hub] Descope Agentic Identity Hub. https://www.descope.com/blog/post/agentic-identity-hub. Read .