Minutes — Agent Communication Protocols (agentproto) BoF
IETF 126, Vienna — Thursday 23 July 2026, 09:00–11:00 CEST
Room: Grand Park Hall 2
Area: ART · Responsible AD: Charles Eckel
Chairs: Leslie Daigle, Orie Steele
Note-takers: Kehan Yao, Laurent Ciavaglia
Type: WG-forming BoF
STATUS: DRAFT for chair review. Compiled from the note-takers'
minutes, the
#agentproto Zulip chat, and the presented slides. Speaker names and
affiliations are provisional — verify against the Meetecho
recording and
blue sheets. Attendance figures are not yet available. These minutes
record what
was said and the sense-of-the-room results; consensus is confirmed on
the list.
Materials:
Summary of results
Sense of the room taken by show of hands (Meetecho). Not binding —
consensus
to be confirmed on the mailing list.
| # | Question | Yes | No | No opinion |
| - - -: -: -:
| 1 | Problem well-understood, solvable, useful? | 124 | 72 | 14 |
| 2 | Need for interoperability clear? | 155 | 30 | 8 |
| 3 | IETF the right place? | 158 | 30 | 14 |
| 4 | Initial scope correct? | 38 | 124 | 40 |
| 5 | Initial deliverables correct? | 92 | 58 | 49 |
| 6 | Form a WG with this charter? | 154 | 51 | 5 |
| 7 | Willing to write/review drafts? | 137 | 17 | 40 |
| 8 | Willing to implement the protocols? | 42 | 28 | 40 |
The room showed strong support that the problem is worth solving, that
the need
for interoperability is clear, and that the IETF is the right venue; and
support
for forming a working group. The initial scope as written was not
supported
(Q4) and views on the deliverables were split (Q5). At wrap-up, Laurent
Ciavaglia
noted that the "is it correct" questions (Q4/Q5) should not be read as
"is it
complete." The chairs will take the results, and the charter/scope
discussion, to
the mailing list.
1. Introduction & administrivia (Chairs)
The chairs opened the session, displayed the Note Well, reviewed meeting
mechanics (Meetecho for the mic queue and shows of hands; state name +
affiliation
at the mic), and called for note-takers (Kehan Yao and Laurent Ciavaglia
volunteered). The chairs stated this is a WG-forming BoF: the goal
is to
decide whether to charter a working group, not to design protocols;
charter text
would be displayed throughout and detailed technical discussion is
reserved for a
WG if one forms. The current charter link was shown.
- Stephen Farrell: asked for more time for discussion; noted
discussion should
continue on the mailing list and that proponents were not fully
represented in
the room.
2. How this BoF relates to work happening elsewhere (Chairs)
The chairs positioned agentproto relative to related efforts (DAWN,
DMSC, WIMSE,
OAuth; Linux Foundation A2A and MCP), stating agentproto can reference
and
coordinate with that work but cannot direct it, and that detailed
discussion of
those topics belongs in their own venues.
3. Motivations: use cases → requirements (Proponents)
Presented by Laurent Ciavaglia (Nokia), Yao Kehan (China Mobile), Lionel
Morand
(Huawei). Framing: agentic systems are moving from isolated assistants
toward a
network of agents and services at Internet scale, creating a risk of
fragmentation without shared protocol work; operators need deployable,
interoperable approaches across trust boundaries. Method: describe key
interaction
patterns, derive protocol requirements, keep them deployment-neutral.
Six
interaction patterns were presented (single-agent; orchestrator +
agents;
long-running with authorization checkpoint; peer multi-hop; cooperative
reasoning/consensus; tool/data/API mediation).
Clarifying questions only:
- Aijun Wang: What is the gap? — Laurent Ciavaglia: the work
already
identifies gaps and precise protocol requirements (common and
function-specific); the group should build on this.
- Grace Rachmany (chat): "fragmentation" could also be framed as
early-phase
experimentation; unclear the IETF is the place to define frameworks.
- Eliot Lear (chat): would like to understand what the trust
boundary really
is.
4. Multimodal support & ties to session/transport (Proponents)
Presented by Suresh Krishnan (Cisco), Dapeng Liu (Alibaba Group), Cullen
Jennings
(Cisco). Motivation for multimodal support: diverse latency needs within
one
conversation (real-time media, semi-real-time text, non-real-time bulk
data);
need to synchronize across modalities (e.g., a control-channel
cancellation
preempting a bulk transfer); and a protocol-agnostic substrate reusable
by MCP,
A2A, and others. A worked "book a business trip" example ("cancel the
hotel, keep
the flight") illustrated cross-party/cross-hop cancellation, with the
observation
that HTTP (stateless), WebSocket (no multiplexing/priority/partial
teardown) do
not address it and MoQ is promising but not agent-aware. Proposed scope:
a
session layer between the application (MCP/A2A) and transport
(MoQ/WebTransport,
over QUIC/UDP).
Discussion (chat):
- Grace Rachmany: the "Session" scope is clear and distinct; the
"Framework"
part and its outputs are harder to grasp. — Charles Eckel (AD):
the
framework is intended to describe how to combine the building blocks
with the
proposed session protocol.
- chris hood: suggested the name
agentsession rather than
agentproto.
- George Fletcher (mic): this does not feel AI-specific — it
sounds like tying
disparate transports into one logical whole; is that the intended
goal? (Noted
agents may have requirements not seen from other use cases.)
- Jonathan Rosenberg (chat): the session protocol resembles SIP in
its desire
to convey conversational content (voice, text, etc.).
5. Session: managing context across an interaction (Proponents)
Presented by Hesham Moussa (Huawei Technologies Canada), Arashmid
Akhavain
(Huawei Technologies Canada). Framing: agentic networks involve multiple
interacting participants and multimodal, long-/short-lived, stateful,
chained,
parallel interactions that can be interrupted, modified, cancelled,
paused, or
resumed. Context is "the glue" tying artifacts and sub-tasks to
tasks/workflows;
a session layer is proposed to impose structure, anchor context, and
prevent
cross-task contamination. Requirements discussed included resilience to
system-level failures (context "hydration," tool timeout/rollback,
graceful
rejoin, loop detection), multi-participant support (hierarchical session
tree,
fault isolation/"blast radii"), and concurrent multimodal stream
handling. The
"why IETF" argument: QUIC, HTTP/2, WebTransport, and MoQ provide pieces
but none
natively manage agent context across turns/interrupts/reconnects —
"that's the
gap."
Discussion:
-
Maxwell Gerber (chat): the upcoming MCP spec removes
protocol-level sessions
and the Mcp-Session-Id header (Streamable HTTP), making MCP
stateless — how
would a new session layer interact with MCP? Later noted he might be
over-indexing on the word "Session," which the application layer
uses to mean
something specific.
* Zaheduzzaman Sarker (chat): this is not a separate session layer
but a
session handling multimodal and context, bound to the transport
protocol.
* Brian Carpenter (chat): the session crossing trust boundaries
makes
everything harder. — George Fletcher (chat): agreed; crossing
trust domains
must be a requirement.
* Ted Hardie (mic): SIP/WebRTC provide session/context management
mostly at
initiation; asked whether this context protocol is set-up-only or
must persist
throughout the interaction to add/remove parties. — Hesham
Moussa: it is
expected to persist.
* Peng Liu (mic): clarification of "agentic network" would help.
* Thomas McCarthy-Howe (chat): shared
draft-howe-sipcore-mcp-extension as an
exploration of the MCP/session intersection; MCP's statelessness is
immaterial
to this layer.
* Stephen Farrell (chat): assumes authorization information
accumulates along
the hops in the path (or tree).
* Mark Nottingham (chat): why is building this into the protocol
better than
managing it at the endpoints?
* Richard Barnes / Brian Trammell (chat): an "endpoint" here is
the program
people call an agent; Barnes suggested this looks like an
application-not-protocol problem and asked for an example of such a
session
layer in a less-dynamic setting; noted none of
DNS/HTTP/SMTP/SSH/IPsec support
pause/resume. — Eliot Lear (chat): a gap analysis seems a fine
next step.
6. Framework: connecting to work in other groups (Proponents)
Presented by Dapeng Liu (Alibaba Group), Hesham Moussa (Huawei).
Framing: agent
communication needs coordinated building blocks; the framework defines
how they
compose into one agent scenario. A layered diagram placed agentproto at
the Agent
Session layer, consuming security/identity work (WIMSE, OAuth,
webbotauth),
discovery (DAWN), and transport (MoQ/QUIC/WebTransport/WebRTC, TSVWG). A
four-step
coordination model was presented (identify gap → present requirement →
related WG
→ consume output), with the framework referencing building blocks and
identifying
gaps.
Discussion:
- Altanai Bisht (mic): is this layer protocol-agnostic?
- Houda Labiod (mic): raised a point about the evidence layer.
- Kathleen Moriarty (chat): asked whether the OAuth community was
represented;
noted OAuth has been found not to fit and that proposals exist (from
Dick Hardt,
and from Pieter Kasselman with Yaroslav).
- Thomas Hardjono (chat): will the framework address agent
ownership
mechanisms to designate legal liabilities? The American Bar
Association is
interested.
- Brian Trammell (chat): microservice environments stuff a
trace-id (stack)
into the RPC for observability — works in closed, not open,
environments.
- Richard Barnes (chat): are there examples of such a session
layer working in
a less-dynamic setting?
7 & 8 Discussion (Chairs facilitate)
Mic queue, with interventions as recorded:
- Nicholas Jones (chat): sketched a context/trust lifecycle —
requestor
identity and trust; service/feature discovery and trust; declaration
of intent
and trust; propagation of intent-trust across a boundary (not
necessarily
requestor identity, for privacy); re-discovery and re-declaration of
intent
given new goals but the same identities — with requestor identity as
the one
constant.
- Ted Hardie: framed the work not as a session layer but as
context that
needs to be propagated — multi-party, across trust boundaries and
modalities;
complicated but tractable. Proposed the charter describe a
signaling protocol
for the set-up and management of context propagation across trust
boundaries,
multimodally, for multiple parties — noting (per Jonathan
Rosenberg's chat point)
that past session initiation (SIP, WebRTC) was endpoint-focused,
whereas here the
context must move with the party across devices/time. Suggested
reframing the
charter around "context propagation" and doing the framework
first rather
than in parallel, which would help MCP/A2A folks see this as a
context-propagation
signaling protocol rather than a replacement for their protocols.
Supportive of
rewriting the charter along these lines.
- Brian Trammell: cautioned that "context propagation" will
confuse AI
researchers — terminology needs work. Core question: what is the
minimum
viable set of primitives needed to make what is new here work?
These are just
programs talking to each other; what is different is the
dynamicity of
connectivity and deployment. With a smaller scope focused on that
minimal
primitive set, there is something the IETF can productively do.
- Stephen Farrell: agreed with Ted Hardie and Brian Trammell;
scope could be
smaller, though questioned whether the world would pay attention;
concerned the
authorization information to be passed around is very complicated
with no proof
of concept that it can be handled safely; suggested the framework
part might
best be dropped, and that the group wait for others to produce a
proof of
concept, then decide what gaps to fill.
- Justin Richer: on context attenuation as it crosses boundaries —
attenuation
is often an expansion of rights within a limited scope; not every
part of the
system should know everything or hold the full rights set. Sees the
framework as
describing the slots that identity/authorization working groups
fill.
- Suresh Krishnan: the goal is to take outputs from other IETF
groups and
present them in a consumable format; the framework shows how a
reusable substrate
composes existing identity/authorization pieces (e.g., WIMSE, OAuth)
for
interoperability across agent ecosystems — not a new session
protocol.
- Mike Blanche: the term "agent" is very unclear; the charter's
"human-to-agent
communication" is ambiguous (client-agent, user-agent, etc.).
- Dan Druta: implementers and operators need to understand the
impact; the
charter should include something to calm "rip-and-replace" concerns.
- Jonathan Rosenberg: Ted's framing helped — replacing "session"
with
"context," this is essentially a context management protocol:
start a
context, append real-time audio/video/text, pause, resume, and
manage it across
devices. Distinct from SIP (a point-to-point ephemeral connection);
one protocol
for creating/managing context serves user-to-agent, agent-to-agent,
and
agent-to-tool. In favor of the framework as a way to understand the
layers.
- Arnaud Taddei: concerned about the charter's definition of AI;
liked the
multimodal material from Suresh and Cullen and would make that the
heart of the
WG; against the framework; suggested leveraging ITU work and
asked the group
not to redefine identity/semantics work others are already doing.
- Altanai Bisht: objected to "AI agent behavioral security" being
categorically
out of scope — not to solve deepfakes, but if the protocol can help
the
application layer, it should enable audit signals so applications
can detect
misuse (e.g., fake calls, synthetic media).
- Zaheduzzaman Sarker: will not define "AI agent" here (drafts
exist); context
propagation across boundaries is about traceability and
accountability (and can
hide some things when crossing boundaries); both control signaling
and
communication must be multimodal; agent communication is a protocol
suite, and
the framework binds the protocols the IETF defines.
- Cullen Jennings: some use cases may not be solvable with
reasonable security
today; wants security properties well beyond current practice;
IETF's rigor on
privacy/security is a reason to do the work here.
- Muhammad Jadoon: can "AI Agent" be defined before defining
problems?
- Suresh Krishnan: on authorization/behavioral policy — what the
agent is, what
it is authorized to do, and how policy is communicated — this is
expected to be
done in OAuth, not here.
- Suhas Nandakumar: implementer perspective — dozens of agentic
frameworks each
with their own transport, no standard wire format, security gaps
from "ambient
keys," ad-hoc non-scaling agent-tool discovery, bolted-on real-time;
the
"n-squared" custom-glue problem. A unified session would help and
enable future
interoperability — supports the work.
- Naveed Ihsanullah: gap-analysis question — the charter motivates
auditability
and independent revocation, but sessions end and credentials expire;
audit is
only worth building if you can identify who was responsible for an
agent's
actions. Identity is routed to WIMSE/OAuth, but those are runtime
credentials,
not a durable owner — will the gap analysis name durable
ownership as a
building block, or assume it is covered elsewhere (and if so,
where)?
- Lionel Morand: definitions of "AI agent" (and of tool, user)
will be
clarified in one of the drafts; context management is not
necessarily
AI-specific, but there are concrete AI-agent use cases — addressing
at least one
specific use case is the right way to progress; the IETF is the
right place
because the solution builds on IETF protocols.
- Pamela Dingle: suggested the charter debate several
possibly-missing items:
whether orchestration is the same thing (for disambiguation);
cross-domain
implications (be more specific than "Internet or intranet");
performance;
and revocation — starting a session is easy, revoking it is hard
(cf.
federation), especially if the agent is no longer available.
- Arashmid Akhavain: agents traverse many functional blocks
(identity,
security, authorization); this WG works on one of the most important
parts but
needs other WGs for identity/authorization; the aim is an inviting
environment
so outside parties bring work here and collaborate.
- Aijun Wang: have there been discussions/coordination with
open-source
communities? Such cooperation should be encouraged and supported.
- Yanmei Liu (Alibaba): the agent protocol for multimodal
communication is
useful (they have scenarios); recommended the WG also consider
low-latency
user-agent communication; noted Alibaba is deploying MCP.
-
Dapeng Liu: David (from MCP) raised a PR to the charter, showing
willingness
to cooperate with the IETF.
-
Thomas Hardjono: on the charter's "authenticated independently
of the users
they represent" — can an autonomous agent operate on self-contained
hardware
(e.g., autonomous medical robots)?
- Brian Trammell: what is new here is that interaction dynamicity
makes a
propagated identifier plus primitive propagation rules potentially
worth
standardizing; the framework should serve only as a terminology
reference.
- Eliot Lear: frameworks are a risk (cf. a framework RFC that was
arguably
never deployed), but if one or two building blocks get built, that
is something;
exposing the implicit framework can highlight what is missing.
- Jonathan Rosenberg: session primitives can be provided while
retaining
horizontal scale — part of why a new protocol is warranted; MCP's
own struggle
with this is evidence of the need.
- Dick Hardt: "session" implies a two-party connection and may be
too limiting;
AAuth uses a "mission" concept giving context for many interactions
pursuing a
goal. — George Fletcher: cf. Karl McGuinness's
"mission-bound-authorization";
overlap unclear. — Ted Hardie: a state token saying "related to
mission X"
differs from a token authorizing an action; keep them separate. —
Jeff
Lombardo: mission is the machine state of the original ask and
derived work —
orthogonal to the technical communications session.
- Arnaud Taddei: it would be good if the WG focused on multimodal.
- Zaheduzzaman Sarker: context propagation across
multi-domain/multi-party also
needs binding to the substrate transport protocol.
- Santosh Pallagatti: MCP and A2A already do session and context
at scale and
now live at the Linux Foundation — what motivates those communities
to re-plumb
onto a new IETF session substrate?
- Parisa Foroughi: A2A already has a
context id primitive shared
across
agents working toward the same objective, plus task and artifact ids
propagated
over HTTP; asked what, beyond sharing identity, is important here
(delegation and
attenuation can be discussed separately). — Brian Trammell: this
WG could
define context-id semantics to slot into A2A, etc.
- Sam Betts: AAIF is working on a taxonomy; hopes the group can
adopt those
terms.
- Cullen Jennings: context could be split into parts with
fine-grained access
permissions per agent; a wallet is one possible approach but not
assumed.
- Artur Hecker: separate the use-case-specific structure of
context from the
protocol definition, or the work will never finish; meta-info plus
pointers to
opaque blocks may be the most that should be attempted.
- Frederik Jacobsen: for this discussion, an agent is essentially
a pattern of
interaction, consistent with the research literature.
- Brian Trammell (mic): asked whether a PR to the charter could be
submitted
now. — Orie Steele (chair): yes; contributions welcome. —
Charles Eckel
(AD): welcomed PRs.
Additional active chat participants (interventions in the transcript):
Bumblefudge,
Pedro Martinez-Julia, Chris Lemmons, Erik Nygren, Brent Zundel, Danny
Zollner, and
others.
The chairs took a show of hands on the seven consensus questions from
the slides
(plus an eighth, on willingness to implement, added at the session).
Results are
tabulated in Summary of results above.
10. Wrap-up & next steps (Chairs)
The chairs indicated they would read back the consensus and the named
contention
points, and that discussion continues on the mailing list and the group
datatracker page. Thanks were given to the note-takers.
Wrap-up interventions (as recorded):
- Grace Rachmany: the session/context part is squarely within
IETF, but AI is
different — it moves and mutates fast, amid a large geopolitical
shift (noting
the growing influence of Southeast Asian and Chinese developers).
Concern about
the revocation and transformation of specifications: the IETF
needs room to
make such shifts to stay relevant. Process question: how quickly can
the IETF
change if the chosen framework turns out not to be the right path?
- Weiqiang Cheng: the IETF should establish agent-communication
working
group(s) to keep pace with outside communities.
- Roberta Robert: welcomed having a dedicated place to do this
work rather than
losing the idea "in a sea of not being a working group."
- Suresh Krishnan: concerned the discussion will be lost if it is
not on the
mailing list or the charter PR; asked the chairs to run a
time-boxed call for
comments/contributions to preserve momentum before the next
meeting.
- Laurent Ciavaglia: the poll question "is it correct" should not
be confused
with "is it complete."
Responsible AD (Charles Eckel): thanked the chairs and confirmed
that a new
mailing list will be created, and encouraged continued charter
refinement.
Action items / next steps
- A new mailing list will be created (confirmed by the AD); chairs
to post the
sense-of-the-room results there and confirm consensus.
- Chairs to open charter/scope revision on the list (Q4 was not
supported); charter
PRs are welcome (per the exchange in item 8; a PR from the MCP side
was noted).
- Run a time-boxed call for comments/contributions to preserve
momentum
(requested by Suresh Krishnan at wrap-up).
- Call for document reviewers and editors (Q7: 137 willing to
write/review).
Acknowledgement
These draft minutes were compiled by co-chair Orie Steele using an AI
agent
harness (Claude Code, Anthropic) with the Claude Opus 4.8 model, from
the human
note-takers' live minutes, the #agentproto Zulip transcript, and the
presented
slides (slides-126-agentproto-agentproto-03). The draft is provided
for review
and correction by the chairs and participants; responsibility for the
final,
corrected minutes rests with the chairs.