Spherical Cow Consulting

Translating geek to human

WIMSE is Where Workload Identity is Getting Interesting

Learn why workload identity is becoming increasingly important as cloud infrastructure, distributed systems, and AI agents interact across organizational boundaries. The WIMSE working group at the IETF is developing ways to communicate workload identities and security contexts across environments, building on existing standards rather than creating an entirely new identity framework.

This episode explores workload authentication, cryptographic proof, delegation, attestation, and discovery, while examining how AI agents complicate trust and authorization. Discover why proving what a workload is differs from deciding what it can do, and how standards work is addressing these emerging challenges.

W3C, IETF, and the Emerging Shape of AI Standards

Heather examines the growing landscape of AI standards at the W3C and IETF, exploring how different groups address content disclosure, AI content preferences, automated client authentication, agent capabilities, and identity. Although these efforts may appear to overlap, they often tackle distinct problems at different layers of web and Internet architecture.

This episode explores why clear standards boundaries and coordination matter as AI systems become more interconnected. Heather considers the risks of incompatible assumptions between protocols and explains why interoperability, rather than one universal AI protocol, will be essential to building a coherent ecosystem.

Two Approaches to AI Agent Discovery

Heather explores two emerging approaches to AI agent discovery: the W3C AI Agent Protocol Community Group and the proposed IETF Discovery of Agents with Names (DAWN) Working Group. She examines how their scopes differ, from broad agent architecture and capabilities to the narrower problem of finding an AI resource.

This episode considers why discovery is more than search, and why boundaries matter. Heather examines what information discovery should reveal, how identity and trust fit into the architecture, and whether narrower standards may ultimately be easier to reuse and build upon.

OAuth Is Asking What Authorization Needs to Become

Learn why OAuth is being pushed to reconsider what authorization needs to become as software grows more autonomous. Heather examines recent OAuth working group discussions around proof of possession, HTTP message signatures, threat models, and the architectural question of where software identity should live.

The episode explores how agentic AI complicates delegated authorization, particularly when multiple software actors, permissions, and contexts are involved. Heather considers whether OAuth needs new extensions or whether some problems belong elsewhere, and why defining clear boundaries may matter more than creating another protocol.

What It’s Actually Like to Serve on the W3C TAG

Heather explores what it’s actually like to serve on the W3C Technical Architecture Group, from reviewing emerging web technologies to navigating architectural questions, consensus, and unfamiliar areas of the web platform. Rather than requiring expertise in every technology, TAG work depends on deep knowledge, curiosity, breadth, and the ability to ask useful questions.

This episode examines how to build toward TAG service through W3C participation, standards work, and cross-domain thinking. Heather also discusses the real commitment involved, including workload, travel, employer support, funding, and the importance of maintaining independence while contributing to web architecture.

The Verifier Has an Interoperability Problem Too

In this episode, Heather examines the gap between technical interoperability and real-world digital identity deployment. Wallets and verifiable credentials may successfully exchange information, but relying parties must navigate different wallets, browsers, operating systems, credential formats, trust models, and failure states.

This episode explores why interoperability must include the full customer experience, not just protocol conformance. Heather considers the growing role of intermediaries, APIs, and verification platforms in absorbing complexity, while asking what happens to trust, privacy, correlation, and governance when another layer enters the identity transaction.

Someone Still Has to Accept the Credential

Discover how digital wallets and verifiable credentials are moving from pilots into real-world adoption, while revealing a critical gap: someone still has to accept the credential. Heather examines the verifier’s perspective, particularly as regulation accelerates digital identity adoption across Europe.

This episode explores why compliance alone is not enough to create meaningful value. Heather considers how credentials could reduce manual review, fraud, data retention, and onboarding friction, while improving customer experience. The key question is simple: when a credential arrives, what old process goes away?

A Field Guide to Identity Conferences: Which One Should You Attend?

Discover how identity conferences can help practitioners stay current on digital identity, emerging standards, regulation, cybersecurity, and the challenges organizations are preparing to solve. Heather examines why choosing the right event matters when budgets, travel, and time are limited, and why there is no single best conference for everyone.

This episode explores how to match conferences to your goals, whether you need enterprise identity insight, European policy perspectives, authentication expertise, or longer-term architectural thinking. Heather also considers what recordings miss: the informal conversations, unexpected connections, and human network that make conference attendance valuable.

Standards Transparency: Public Isn’t the Same as Understandable

Heather examines why making standards information public is not enough to make the work understandable. This episode explores the growing challenge of navigating specifications, document status, provenance, working group activity, and related standards across digital identity, AI, security, privacy, and other overlapping technical domains.

Learn how structured standards data, APIs, and AI tools can make research more efficient without replacing human judgment. Heather explains why better transparency means making process context accessible, so implementers, architects, policymakers, researchers, and analysts can make informed decisions without years of institutional knowledge.

Keeping Up With Standards Without Pretending You Can Keep Up

Heather explores why keeping up with standards development does not mean tracking everything. This episode looks at how a lightweight standards radar can surface emerging work across digital identity, AI, authorization, credentials, and related technologies, while recognizing that new ideas appear far faster than any individual can follow.

Discover how automation, structured public data, and human judgment can work together to identify what deserves closer attention. Heather explains why Internet-Drafts provide signals rather than certainty, how context reveals momentum, and why useful awareness—not perfect completeness—is the more realistic goal.