What happened
On 16 October 2026 (datatracker 'Last updated 2026-10-16'), the individual Internet-Draft 'An Audit Record Format for AI Agent Authorization Decisions' (draft-gilda-audit-agent-audit-record-00, Sankalp Gilda) was posted, replacing draft-gilda-wimse-agent-audit-record. It defines a record format for AI agent authorization decisions and the effects that followed, using one in-toto predicate signed inside a DSSE envelope. The record carries the decision and observed effect with a derived agreement between them, decision-point freshness, a canonicalisation contract allowing a party trusting neither agent nor operator to recompute consistency from its bytes, plus retained-record dating anchors. It carries the seven minimum audit fields of the WIMSE AI Identity Management System framework and is offered as the data model for audit records the proposed AUDIT working group would specify.
Why it matters
With agentic AI adoption racing ahead of audit practice, there is currently no standard, tamper-evident format for recording AI agent authorization decisions and their effects. This draft is a concrete, DSSE-signed proposal that connects the agent-identity (WIMSE), OAuth agent-authorization and audit streams, and is explicitly positioned to seed the proposed AUDIT WG — an important reference for anyone building agent audit trails.
Action needed
Observability and audit tooling vendors and enterprise security teams planning agent audit logging should review the record format and contribute to the proposed AUDIT WG discussion (audit@ietf.org); track development of the format for potential adoption.