A certificate extension listing the higher-level purposes the certificate may serve, expressed as OIDs — for example Server Authentication (1.3.6.1.5.5.7.3.1) and Client Authentication (1.3.6.1.5.5.7.3.2). Validators reject certificates used for a purpose not present in the EKU, so a client certificate without Client Authentication will fail 802.1X even if everything else is correct. It complements the lower-level key usage extension.
EKU
Extended Key Usage