Problem Statement for Autonomous Agent Protocol Gaps

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 7 September 2026.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Autonomous software agents are moving from research prototypes to production deployments in network management, cloud orchestration, supply-chain logistics, and AI-driven workflows. A survey of IETF work reveals over 260 drafts relevant to agent capabilities, yet no single reference architecture ties them together. Several critical capabilities -- runtime behavioral verification, failure cascade prevention, cross-vendor human override -- lack any standardization at all.¶

This document distills the findings of a comprehensive gap analysis [ARXIV-GAP] into an actionable problem statement. It identifies eleven gaps, groups them by severity, and presents a solution roadmap of nine companion drafts. The full analysis, including a survey of existing IETF work across WIMSE, RATS, OAuth/GNAP, SCITT, and NMOP, is available in [I-D.nennemann-agent-dag-hitl-safety] and the companion arXiv paper [ARXIV-GAP].¶

The intended audience is working group chairs, area directors, and protocol designers who need a concise summary of what is missing and what to build next.¶

2. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The following terms are used throughout this document:¶

Agent:

A software component that acts on behalf of a principal (human or organizational) to perform tasks autonomously.¶

ECT (Execution Context Token):

A cryptographically signed token carrying execution context for an agent action. See [I-D.nennemann-wimse-ect].¶

ACP (Agent Context Policy):

A policy specifying permitted behaviors, resource limits, and escalation rules for an agent. See [I-D.nennemann-agent-dag-hitl-safety].¶

HITL (Human-in-the-Loop):

A control pattern requiring human approval before an agent action takes effect.¶

Cascade Failure:

A failure mode where an error in one agent propagates through a multi-agent workflow, causing successive agents to fail.¶

Override Signal:

A message from a human operator instructing an agent to halt, modify, or roll back its current action.¶

3. Problem Landscape

The autonomous agent ecosystem can be organized into four layers, each with distinct standardization gaps. The following diagram presents this reference architecture:¶

+-------------------------------------------------------------+
|                    HUMAN OPERATORS                           |
|             [Override & HITL Layer -- GAP 7]                 |
+-------------------------------------------------------------+
|                  AGENT INTERACTION LAYER                     |
|  +---------+  +---------+  +---------+  +---------+         |
|  | Agent A |<>| Agent B |<>| Agent C |<>| Agent D |         |
|  +----+----+  +----+----+  +----+----+  +----+----+         |
|       |  GAP 3:    |  GAP 10:   |  GAP 1:    |              |
|       |  Consensus |  Cap.Neg.  |  Behav.    |              |
|       |            |            |  Verif.    |              |
+-------+------------+------------+------------+--------------+
|                  EXECUTION LAYER (ECT)                       |
|  DAG Execution | Checkpoints | Rollback | Circuit Breakers  |
|  [GAP 2: Cascade Prevention]  [GAP 4: Rollback]             |
+-------------------------------------------------------------+
|                  POLICY & GOVERNANCE LAYER                   |
|  ACP-DAG-HITL | Trust Scoring | Assurance Profiles          |
|  [GAP 5: Federated Privacy]  [GAP 6: Cross-Domain Audit]    |
+-------------------------------------------------------------+
|                  INFRASTRUCTURE LAYER                        |
|  Identity | Discovery | Registration | Protocol Bridges     |
|  [GAP 8: Cross-Protocol]  [GAP 9: Resource Accounting]      |
|  [GAP 11: Performance Benchmarking]                          |
+-------------------------------------------------------------+

Human Operators Layer:

Provides override and human-in-the-loop controls. Gap 7 addresses the absence of a cross-vendor override protocol.¶

Agent Interaction Layer:

Where agents communicate, negotiate capabilities (Gap 10), reach consensus (Gap 3), and undergo behavioral verification (Gap 1).¶

Execution Layer:

Manages DAG-based workflows with cascade prevention (Gap 2) and rollback (Gap 4), built on Execution Context Tokens [I-D.nennemann-wimse-ect].¶

Policy and Governance Layer:

Enforces privacy in federated learning (Gap 5) and cross-domain audit trails (Gap 6).¶

Infrastructure Layer:

Handles identity, discovery, cross-protocol migration (Gap 8), resource accounting (Gap 9), and performance benchmarking (Gap 11).¶

4. Critical Gaps

5. Solution Roadmap

  behavioral-verification ---+
          |                   |
          v                   |
  cascade-prevention          |
          |                   |
          v                   v
  override-protocol    cross-domain-audit
          |                   |
          v                   v
      consensus        federation-privacy

6. Recommended Prioritization

Work should proceed in three phases:¶

Phase 1 -- Safety Foundation (Immediate):

Behavioral Verification (Gaps 1, 11) and Cascade Prevention (Gaps 2, 4). These are CRITICAL severity gaps with direct safety implications. Without runtime verification and failure containment, no autonomous agent deployment can be considered safe.¶

Phase 2 -- Control and Accountability (Near-term):

Human Override (Gap 7) and Cross-Domain Audit (Gaps 6, 9). Override capability is a prerequisite for any production deployment. Audit trails are required for regulatory compliance in enterprise environments.¶

Phase 3 -- Interoperability and Scale (Medium-term):

Consensus (Gaps 3, 10) and Federation Privacy (Gaps 5, 8). These enable multi-vendor and multi-domain agent ecosystems but depend on the safety and accountability foundations from Phases 1 and 2.¶

7. Security Considerations

The gaps identified in this document have cross-cutting security implications:¶

• Behavioral Verification (Gap 1): Without runtime verification, compromised agents exploit trusted identities to perform unauthorized actions undetected.¶

• Cascade Prevention (Gap 2): Absence of containment creates a denial-of-service vector where compromising a single agent disrupts entire multi-agent workflows.¶

• Human Override (Gap 7): Without a standard override protocol, safety-critical agent actions may not be stoppable in emergency situations.¶

• Cross-Domain Audit (Gap 6): Audit trail gaps across domain boundaries enable agents to evade detection and accountability.¶

• Federated Privacy (Gap 5): Sharing agent data across domains without privacy controls exposes network topology, operational patterns, and business logic.¶

Implementers of autonomous agent systems SHOULD treat the CRITICAL and HIGH severity gaps as security requirements and prioritize their resolution. The companion drafts each contain detailed security considerations specific to their scope.¶

8. IANA Considerations

This document has no IANA actions.¶

9. References

Appendix A. Acknowledgments

The author thanks the participants of the WIMSE, RATS, and NMOP working groups for discussions that informed this analysis. The full gap analysis is available as [ARXIV-GAP].¶

Author's Address