Minutes — Agent Communication Protocols (agentproto) BoF

IETF 126, Vienna — Thursday 23 July 2026, 09:00–11:00 CEST
Room: Grand Park Hall 2
Area: ART · Responsible AD: Charles Eckel
Chairs: Leslie Daigle, Orie Steele
Note-takers: Kehan Yao, Laurent Ciavaglia
Type: WG-forming BoF

STATUS: DRAFT for chair review. Compiled from the note-takers'
minutes, the
#agentproto Zulip chat, and the presented slides. Speaker names and

affiliations are provisional — verify against the Meetecho
recording and
blue sheets. Attendance figures are not yet available. These minutes
record what
was said and the sense-of-the-room results; consensus is confirmed on
the list.

Materials:

• Slides: slides-126-agentproto-agentproto-03 (datatracker).
• Draft charter:
  https://github.com/ietf-artarea/charters/blob/main/agentproto/charter.md
• Notes: https://notes.ietf.org/notes-ietf-126-agentproto ·
  Chat: #agentproto on zulip.ietf.org

Summary of results

Sense of the room taken by show of hands (Meetecho). Not binding —
consensus
to be confirmed on the mailing list.

| # | Question | Yes | No | No opinion |
| - - -: -: -:
| 1 | Problem well-understood, solvable, useful? | 124 | 72 | 14 |
| 2 | Need for interoperability clear? | 155 | 30 | 8 |
| 3 | IETF the right place? | 158 | 30 | 14 |
| 4 | Initial scope correct? | 38 | 124 | 40 |
| 5 | Initial deliverables correct? | 92 | 58 | 49 |
| 6 | Form a WG with this charter? | 154 | 51 | 5 |
| 7 | Willing to write/review drafts? | 137 | 17 | 40 |
| 8 | Willing to implement the protocols? | 42 | 28 | 40 |

The room showed strong support that the problem is worth solving, that
the need
for interoperability is clear, and that the IETF is the right venue; and
support
for forming a working group. The initial scope as written was not
supported
(Q4) and views on the deliverables were split (Q5). At wrap-up, Laurent
Ciavaglia
noted that the "is it correct" questions (Q4/Q5) should not be read as
"is it
complete." The chairs will take the results, and the charter/scope
discussion, to
the mailing list.

1. Introduction & administrivia (Chairs)

The chairs opened the session, displayed the Note Well, reviewed meeting

mechanics (Meetecho for the mic queue and shows of hands; state name +
affiliation
at the mic), and called for note-takers (Kehan Yao and Laurent Ciavaglia

volunteered). The chairs stated this is a WG-forming BoF: the goal
is to
decide whether to charter a working group, not to design protocols;
charter text
would be displayed throughout and detailed technical discussion is
reserved for a
WG if one forms. The current charter link was shown.

• Stephen Farrell: asked for more time for discussion; noted
  discussion should
  continue on the mailing list and that proponents were not fully
  represented in
  the room.

2. How this BoF relates to work happening elsewhere (Chairs)

The chairs positioned agentproto relative to related efforts (DAWN,
DMSC, WIMSE,
OAuth; Linux Foundation A2A and MCP), stating agentproto can reference
and
coordinate with that work but cannot direct it, and that detailed
discussion of
those topics belongs in their own venues.

• Jari Arkko (chat): noted other activity that week, including
  VCON discussion
  of proposals for tracing agent-related activity.
• Kaliya Young (chat): pointed to a landscape of 160+ (now 200+)
  IETF drafts
  related to agent work:
  https://github.com/nomoticai/ietf-agent-landscape/blob/main/agent-standards-landscape.md

3. Motivations: use cases → requirements (Proponents)

Presented by Laurent Ciavaglia (Nokia), Yao Kehan (China Mobile), Lionel
Morand
(Huawei). Framing: agentic systems are moving from isolated assistants
toward a
network of agents and services at Internet scale, creating a risk of
fragmentation without shared protocol work; operators need deployable,
interoperable approaches across trust boundaries. Method: describe key
interaction
patterns, derive protocol requirements, keep them deployment-neutral.
Six
interaction patterns were presented (single-agent; orchestrator +
agents;
long-running with authorization checkpoint; peer multi-hop; cooperative

reasoning/consensus; tool/data/API mediation).

Clarifying questions only:

• Aijun Wang: What is the gap? — Laurent Ciavaglia: the work
  already
  identifies gaps and precise protocol requirements (common and
  function-specific); the group should build on this.
• Grace Rachmany (chat): "fragmentation" could also be framed as
  early-phase
  experimentation; unclear the IETF is the place to define frameworks.
• Eliot Lear (chat): would like to understand what the trust
  boundary really
  is.

4. Multimodal support & ties to session/transport (Proponents)

Presented by Suresh Krishnan (Cisco), Dapeng Liu (Alibaba Group), Cullen
Jennings
(Cisco). Motivation for multimodal support: diverse latency needs within
one
conversation (real-time media, semi-real-time text, non-real-time bulk
data);
need to synchronize across modalities (e.g., a control-channel
cancellation
preempting a bulk transfer); and a protocol-agnostic substrate reusable
by MCP,
A2A, and others. A worked "book a business trip" example ("cancel the
hotel, keep
the flight") illustrated cross-party/cross-hop cancellation, with the
observation
that HTTP (stateless), WebSocket (no multiplexing/priority/partial
teardown) do
not address it and MoQ is promising but not agent-aware. Proposed scope:
a
session layer between the application (MCP/A2A) and transport
(MoQ/WebTransport,
over QUIC/UDP).

Discussion (chat):

• Grace Rachmany: the "Session" scope is clear and distinct; the
  "Framework"
  part and its outputs are harder to grasp. — Charles Eckel (AD):
  the
  framework is intended to describe how to combine the building blocks
  with the
  proposed session protocol.
• chris hood: suggested the name agentsession rather than
  agentproto.
• George Fletcher (mic): this does not feel AI-specific — it
  sounds like tying
  disparate transports into one logical whole; is that the intended
  goal? (Noted
  agents may have requirements not seen from other use cases.)
• Jonathan Rosenberg (chat): the session protocol resembles SIP in
  its desire
  to convey conversational content (voice, text, etc.).

5. Session: managing context across an interaction (Proponents)

Presented by Hesham Moussa (Huawei Technologies Canada), Arashmid
Akhavain
(Huawei Technologies Canada). Framing: agentic networks involve multiple

interacting participants and multimodal, long-/short-lived, stateful,
chained,
parallel interactions that can be interrupted, modified, cancelled,
paused, or
resumed. Context is "the glue" tying artifacts and sub-tasks to
tasks/workflows;
a session layer is proposed to impose structure, anchor context, and
prevent
cross-task contamination. Requirements discussed included resilience to

system-level failures (context "hydration," tool timeout/rollback,
graceful
rejoin, loop detection), multi-participant support (hierarchical session
tree,
fault isolation/"blast radii"), and concurrent multimodal stream
handling. The
"why IETF" argument: QUIC, HTTP/2, WebTransport, and MoQ provide pieces
but none
natively manage agent context across turns/interrupts/reconnects —
"that's the
gap."

Discussion:

• Maxwell Gerber (chat): the upcoming MCP spec removes
  protocol-level sessions
  and the Mcp-Session-Id header (Streamable HTTP), making MCP
  stateless — how
  would a new session layer interact with MCP? Later noted he might be

  over-indexing on the word "Session," which the application layer
  uses to mean
  something specific.
  * Zaheduzzaman Sarker (chat): this is not a separate session layer
  but a
  session handling multimodal and context, bound to the transport
  protocol.
  * Brian Carpenter (chat): the session crossing trust boundaries
  makes
  everything harder. — George Fletcher (chat): agreed; crossing
  trust domains
  must be a requirement.
  * Ted Hardie (mic): SIP/WebRTC provide session/context management
  mostly at
  initiation; asked whether this context protocol is set-up-only or
  must persist
  throughout the interaction to add/remove parties. — Hesham
  Moussa: it is
  expected to persist.
  * Peng Liu (mic): clarification of "agentic network" would help.
  * Thomas McCarthy-Howe (chat): shared
  draft-howe-sipcore-mcp-extension as an
  exploration of the MCP/session intersection; MCP's statelessness is
  immaterial
  to this layer.
  * Stephen Farrell (chat): assumes authorization information
  accumulates along
  the hops in the path (or tree).
  * Mark Nottingham (chat): why is building this into the protocol
  better than
  managing it at the endpoints?
  * Richard Barnes / Brian Trammell (chat): an "endpoint" here is
  the program
  people call an agent; Barnes suggested this looks like an
  application-not-protocol problem and asked for an example of such a
  session
  layer in a less-dynamic setting; noted none of
  DNS/HTTP/SMTP/SSH/IPsec support
  pause/resume. — Eliot Lear (chat): a gap analysis seems a fine
  next step.

6. Framework: connecting to work in other groups (Proponents)

Presented by Dapeng Liu (Alibaba Group), Hesham Moussa (Huawei).
Framing: agent
communication needs coordinated building blocks; the framework defines
how they
compose into one agent scenario. A layered diagram placed agentproto at
the Agent
Session layer, consuming security/identity work (WIMSE, OAuth,
webbotauth),
discovery (DAWN), and transport (MoQ/QUIC/WebTransport/WebRTC, TSVWG). A
four-step
coordination model was presented (identify gap → present requirement →
related WG
→ consume output), with the framework referencing building blocks and
identifying
gaps.

Discussion:

• Altanai Bisht (mic): is this layer protocol-agnostic?
• Houda Labiod (mic): raised a point about the evidence layer.
• Kathleen Moriarty (chat): asked whether the OAuth community was
  represented;
  noted OAuth has been found not to fit and that proposals exist (from
  Dick Hardt,
  and from Pieter Kasselman with Yaroslav).
• Thomas Hardjono (chat): will the framework address agent
  ownership
  mechanisms to designate legal liabilities? The American Bar
  Association is
  interested.
• Brian Trammell (chat): microservice environments stuff a
  trace-id (stack)
  into the RPC for observability — works in closed, not open,
  environments.
• Richard Barnes (chat): are there examples of such a session
  layer working in
  a less-dynamic setting?

7 & 8 Discussion (Chairs facilitate)

Mic queue, with interventions as recorded:

• Nicholas Jones (chat): sketched a context/trust lifecycle —
  requestor
  identity and trust; service/feature discovery and trust; declaration
  of intent
  and trust; propagation of intent-trust across a boundary (not
  necessarily
  requestor identity, for privacy); re-discovery and re-declaration of
  intent
  given new goals but the same identities — with requestor identity as
  the one
  constant.
• Ted Hardie: framed the work not as a session layer but as
  context that
  needs to be propagated — multi-party, across trust boundaries and
  modalities;
  complicated but tractable. Proposed the charter describe a
  signaling protocol
  for the set-up and management of context propagation across trust
  boundaries,
  multimodally, for multiple parties — noting (per Jonathan
  Rosenberg's chat point)
  that past session initiation (SIP, WebRTC) was endpoint-focused,
  whereas here the
  context must move with the party across devices/time. Suggested
  reframing the
  charter around "context propagation" and doing the framework
  first rather
  than in parallel, which would help MCP/A2A folks see this as a
  context-propagation
  signaling protocol rather than a replacement for their protocols.
  Supportive of
  rewriting the charter along these lines.
• Brian Trammell: cautioned that "context propagation" will
  confuse AI
  researchers — terminology needs work. Core question: what is the
  minimum
  viable set of primitives needed to make what is new here work?
  These are just
  programs talking to each other; what is different is the
  dynamicity of
  connectivity and deployment. With a smaller scope focused on that
  minimal
  primitive set, there is something the IETF can productively do.
• Stephen Farrell: agreed with Ted Hardie and Brian Trammell;
  scope could be
  smaller, though questioned whether the world would pay attention;
  concerned the
  authorization information to be passed around is very complicated
  with no proof
  of concept that it can be handled safely; suggested the framework
  part might
  best be dropped, and that the group wait for others to produce a
  proof of
  concept, then decide what gaps to fill.
• Justin Richer: on context attenuation as it crosses boundaries —
  attenuation
  is often an expansion of rights within a limited scope; not every
  part of the
  system should know everything or hold the full rights set. Sees the
  framework as
  describing the slots that identity/authorization working groups
  fill.
• Suresh Krishnan: the goal is to take outputs from other IETF
  groups and
  present them in a consumable format; the framework shows how a
  reusable substrate
  composes existing identity/authorization pieces (e.g., WIMSE, OAuth)
  for
  interoperability across agent ecosystems — not a new session
  protocol.
• Mike Blanche: the term "agent" is very unclear; the charter's
  "human-to-agent
  communication" is ambiguous (client-agent, user-agent, etc.).
• Dan Druta: implementers and operators need to understand the
  impact; the
  charter should include something to calm "rip-and-replace" concerns.
• Jonathan Rosenberg: Ted's framing helped — replacing "session"
  with
  "context," this is essentially a context management protocol:
  start a
  context, append real-time audio/video/text, pause, resume, and
  manage it across
  devices. Distinct from SIP (a point-to-point ephemeral connection);
  one protocol
  for creating/managing context serves user-to-agent, agent-to-agent,
  and
  agent-to-tool. In favor of the framework as a way to understand the
  layers.
• Arnaud Taddei: concerned about the charter's definition of AI;
  liked the
  multimodal material from Suresh and Cullen and would make that the
  heart of the
  WG; against the framework; suggested leveraging ITU work and
  asked the group
  not to redefine identity/semantics work others are already doing.
• Altanai Bisht: objected to "AI agent behavioral security" being
  categorically
  out of scope — not to solve deepfakes, but if the protocol can help
  the
  application layer, it should enable audit signals so applications
  can detect
  misuse (e.g., fake calls, synthetic media).
• Zaheduzzaman Sarker: will not define "AI agent" here (drafts
  exist); context
  propagation across boundaries is about traceability and
  accountability (and can
  hide some things when crossing boundaries); both control signaling
  and
  communication must be multimodal; agent communication is a protocol
  suite, and
  the framework binds the protocols the IETF defines.
• Cullen Jennings: some use cases may not be solvable with
  reasonable security
  today; wants security properties well beyond current practice;
  IETF's rigor on
  privacy/security is a reason to do the work here.
• Muhammad Jadoon: can "AI Agent" be defined before defining
  problems?
• Suresh Krishnan: on authorization/behavioral policy — what the
  agent is, what
  it is authorized to do, and how policy is communicated — this is
  expected to be
  done in OAuth, not here.
• Suhas Nandakumar: implementer perspective — dozens of agentic
  frameworks each
  with their own transport, no standard wire format, security gaps
  from "ambient
  keys," ad-hoc non-scaling agent-tool discovery, bolted-on real-time;
  the
  "n-squared" custom-glue problem. A unified session would help and
  enable future
  interoperability — supports the work.
• Naveed Ihsanullah: gap-analysis question — the charter motivates
  auditability
  and independent revocation, but sessions end and credentials expire;
  audit is
  only worth building if you can identify who was responsible for an
  agent's
  actions. Identity is routed to WIMSE/OAuth, but those are runtime
  credentials,
  not a durable owner — will the gap analysis name durable
  ownership as a
  building block, or assume it is covered elsewhere (and if so,
  where)?
• Lionel Morand: definitions of "AI agent" (and of tool, user)
  will be
  clarified in one of the drafts; context management is not
  necessarily
  AI-specific, but there are concrete AI-agent use cases — addressing
  at least one
  specific use case is the right way to progress; the IETF is the
  right place
  because the solution builds on IETF protocols.
• Pamela Dingle: suggested the charter debate several
  possibly-missing items:
  whether orchestration is the same thing (for disambiguation);
  cross-domain
  implications (be more specific than "Internet or intranet");
  performance;
  and revocation — starting a session is easy, revoking it is hard
  (cf.
  federation), especially if the agent is no longer available.
• Arashmid Akhavain: agents traverse many functional blocks
  (identity,
  security, authorization); this WG works on one of the most important
  parts but
  needs other WGs for identity/authorization; the aim is an inviting
  environment
  so outside parties bring work here and collaborate.
• Aijun Wang: have there been discussions/coordination with
  open-source
  communities? Such cooperation should be encouraged and supported.
• Yanmei Liu (Alibaba): the agent protocol for multimodal
  communication is
  useful (they have scenarios); recommended the WG also consider
  low-latency
  user-agent communication; noted Alibaba is deploying MCP.

• Dapeng Liu: David (from MCP) raised a PR to the charter, showing
  willingness
  to cooperate with the IETF.

• Thomas Hardjono: on the charter's "authenticated independently
  of the users
  they represent" — can an autonomous agent operate on self-contained
  hardware
  (e.g., autonomous medical robots)?

• Brian Trammell: what is new here is that interaction dynamicity
  makes a
  propagated identifier plus primitive propagation rules potentially
  worth
  standardizing; the framework should serve only as a terminology
  reference.
• Eliot Lear: frameworks are a risk (cf. a framework RFC that was
  arguably
  never deployed), but if one or two building blocks get built, that
  is something;
  exposing the implicit framework can highlight what is missing.
• Jonathan Rosenberg: session primitives can be provided while
  retaining
  horizontal scale — part of why a new protocol is warranted; MCP's
  own struggle
  with this is evidence of the need.
• Dick Hardt: "session" implies a two-party connection and may be
  too limiting;
  AAuth uses a "mission" concept giving context for many interactions
  pursuing a
  goal. — George Fletcher: cf. Karl McGuinness's
  "mission-bound-authorization";
  overlap unclear. — Ted Hardie: a state token saying "related to
  mission X"
  differs from a token authorizing an action; keep them separate. —
  Jeff
  Lombardo: mission is the machine state of the original ask and
  derived work —
  orthogonal to the technical communications session.
• Arnaud Taddei: it would be good if the WG focused on multimodal.
• Zaheduzzaman Sarker: context propagation across
  multi-domain/multi-party also
  needs binding to the substrate transport protocol.
• Santosh Pallagatti: MCP and A2A already do session and context
  at scale and
  now live at the Linux Foundation — what motivates those communities
  to re-plumb
  onto a new IETF session substrate?
• Parisa Foroughi: A2A already has a context id primitive shared
  across
  agents working toward the same objective, plus task and artifact ids
  propagated
  over HTTP; asked what, beyond sharing identity, is important here
  (delegation and
  attenuation can be discussed separately). — Brian Trammell: this
  WG could
  define context-id semantics to slot into A2A, etc.
• Sam Betts: AAIF is working on a taxonomy; hopes the group can
  adopt those
  terms.
• Cullen Jennings: context could be split into parts with
  fine-grained access
  permissions per agent; a wallet is one possible approach but not
  assumed.
• Artur Hecker: separate the use-case-specific structure of
  context from the
  protocol definition, or the work will never finish; meta-info plus
  pointers to
  opaque blocks may be the most that should be attempted.
• Frederik Jacobsen: for this discussion, an agent is essentially
  a pattern of
  interaction, consistent with the research literature.
• Brian Trammell (mic): asked whether a PR to the charter could be
  submitted
  now. — Orie Steele (chair): yes; contributions welcome. —
  Charles Eckel
  (AD): welcomed PRs.

Additional active chat participants (interventions in the transcript):
Bumblefudge,
Pedro Martinez-Julia, Chris Lemmons, Erik Nygren, Brent Zundel, Danny
Zollner, and
others.

9. WG-forming consensus calls (Chairs)

The chairs took a show of hands on the seven consensus questions from
the slides
(plus an eighth, on willingness to implement, added at the session).
Results are
tabulated in Summary of results above.

10. Wrap-up & next steps (Chairs)

The chairs indicated they would read back the consensus and the named
contention
points, and that discussion continues on the mailing list and the group

datatracker page. Thanks were given to the note-takers.

Wrap-up interventions (as recorded):

• Grace Rachmany: the session/context part is squarely within
  IETF, but AI is
  different — it moves and mutates fast, amid a large geopolitical
  shift (noting
  the growing influence of Southeast Asian and Chinese developers).
  Concern about
  the revocation and transformation of specifications: the IETF
  needs room to
  make such shifts to stay relevant. Process question: how quickly can
  the IETF
  change if the chosen framework turns out not to be the right path?
• Weiqiang Cheng: the IETF should establish agent-communication
  working
  group(s) to keep pace with outside communities.
• Roberta Robert: welcomed having a dedicated place to do this
  work rather than
  losing the idea "in a sea of not being a working group."
• Suresh Krishnan: concerned the discussion will be lost if it is
  not on the
  mailing list or the charter PR; asked the chairs to run a
  time-boxed call for
  comments/contributions to preserve momentum before the next
  meeting.
• Laurent Ciavaglia: the poll question "is it correct" should not
  be confused
  with "is it complete."

Responsible AD (Charles Eckel): thanked the chairs and confirmed
that a new
mailing list will be created, and encouraged continued charter
refinement.

Action items / next steps

• A new mailing list will be created (confirmed by the AD); chairs
  to post the
  sense-of-the-room results there and confirm consensus.
• Chairs to open charter/scope revision on the list (Q4 was not
  supported); charter
  PRs are welcome (per the exchange in item 8; a PR from the MCP side
  was noted).
• Run a time-boxed call for comments/contributions to preserve
  momentum
  (requested by Suresh Krishnan at wrap-up).
• Call for document reviewers and editors (Q7: 137 willing to
  write/review).

Acknowledgement

These draft minutes were compiled by co-chair Orie Steele using an AI
agent
harness (Claude Code, Anthropic) with the Claude Opus 4.8 model, from
the human
note-takers' live minutes, the #agentproto Zulip transcript, and the
presented
slides (slides-126-agentproto-agentproto-03). The draft is provided
for review
and correction by the chairs and participants; responsibility for the
final,
corrected minutes rests with the chairs.