| Internet-Draft | I2ICF Framework | November 2026 |
| Jeong, et al. | Expires 6 May 2027 | [Page] |
This document specifies an agentic AI framework for the management of networks, security, and AI services. This framework is an Intent-Based System (IBS) to enforce a human-language intent at a target network with the translated policy for networks, security, or AI services. It consists of a User System, a Cloud System, an Edge System, and a Device. Target devices in this framework include Network Forwarding Elements (e.g., router and switch), Network Security Functions (e.g., firewall, web filter, and DDoS-attack mitigator), Internet-of-Things (IoT) Devices, Physicak AI Robots, Software-Defined Vehicles (SDV), Unmanned Aerial Vehicles (UAV), and Urban Air Mobility (UAM). This document describes the agentic AI framework with its components and interfaces where the components include AI agents and supporting knowledge repositories (i.e., knowledge base), and also inter-agent interfaces use the Agent-to-Agent (A2A) protocol.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 6 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Agentic AI opens a new door providing human users with human-friendly services through Large Language Models (LLMs) such as GPT-3 [GPT-3] and Flan-T5 [Flan-T5]. Also, Network softwarization has been widely adopted in various domains, data centers and mobile networks [TS-23.501]. The network softwarization is realized with Network Functions Virtualization (NFV) [ETSI-NFV][ETSI-NFV-Release-2] and Software-Defined Networking (SDN) [RFC7149]. Furthermore, Intent-Based Networking (IBN)[RFC9315][Survey-IBN-CST-2023][ClickINC] can support human-friendly configuration for target networks and security systems.¶
This document specifies an agentic AI framework for the management of networks, security, and AI services. This framework is an Intent-Based System (IBS) including the IBN that enforces a human-language intent at a target network. It aims at the IBS in data centers, corporate networks, campus networks, and home networks rather than public networks like the Internet.¶
The agentic AI framework in this document supports the translation of a human-language intent and the enforcement of the corresponding service(s) through multiple AI agents in target networks. This intent can be translated into a specific policy for networks, security, or AI services. The agentic AI framework in this document consists of a User System, a Cloud System, an Edge System, and a Device. Devices under the control of this framework include Network Forwarding Elements (e.g., router and switch), Network Security Functions (e.g., firewall, web filter, and DDoS-attack mitigator), Internet-of-Things (IoT) Devices, Physicak AI Robots, Software-Defined Vehicles (SDV) [AUTOSAR-SDV][Eclipse-SDV][COVESA], Unmanned Aerial Vehicles (UAV), and Urban Air Mobility (UAM). Thus, this document describes the agentic AI framework with its components and interfaces where the components are AI agents and the interfaces use the Agent-to-Agent (A2A) protocol [A2A][A2A-Specification].¶
This document uses the terminology described in [RFC9315], and [I-D.irtf-nmrg-ibn-usecases]. The new terms are defined below:¶
AI Agent: the software module that can translate a human-language intent into a structured policy in a Domain-Specific Language (DSL). An AI agent can communicate with another AI agent for collaboration via the Agent-to-Agent Protocol (A2A). It can use available computing, storage, and network resources via Model Context Protocol (MCP) [MCP][MCP-Specification]. The MCP accesses data and file systems, development tools, productivity tool, and physical AI tools for the requested service.¶
Agent Catalog: A logical collection of Agent Cards [A2A-Specification], or references to them, describing AI agents known to the framework. It supports the lookup of candidate AI agents based on their advertised skills and interaction requirements. In this document, the Agent Catalog constitutes the agent-metadata part of the Knowledge Base that is a database for intent translation. Entries in the Agent Catalog may be populated and refreshed through discovery or registration mechanisms. The storage representation and access mechanisms are implementation-specific, so they are out of the scope of this document.¶
Intent: the set of operational goals (i.e., what a network should meet) and outcomes (i.e., what the network is supposed to deliver) defined in a declarative manner without specifying how they are achieved or should be implemented [RFC9315].¶
Intent-Based System (IBS): the system that enforces an intent from a user (or administrator) into a target system (e.g., SDV). An intent can be expressed in Natural Language (e.g., English) and can be translated into a policy (i.e., network policy, security policy, and AI service policy) using Natural Language Processing (NLP) [Flan-T5][GPT-3] [USENIX-ATC-Lumi][BERT] [Deep-Learning]. In this document, an Intent Translator converts natural-language intents into structured policy representations based on [I-D.gu-nmrg-intent-translator]. A specific intent denotes a structured representation of a goal assigned to a Worker Agent and may take the form of a high-level policy. Through the monitoring of the AI agents, the activity and performance of the AI agents is monitored and analyzed. If needed, the rules of the specific intent or the high-level policy are augmented or new rules are generated and delivered to appropriate AI agents for reconfiguration.¶
Knowledge Base (KB): A logical repository that provides domain-specific policy knowledge and agent metadata used by the framework. Policy knowledge includes target schemas, valid policy examples, and semantic constraints, drawing on the Policy Knowledge Base concept described in [I-D.gu-nmrg-intent-translator]. In this document, agent metadata is organized as an Agent Catalog. Policy knowledge and agent metadata are distinct logical categories and may reside in separate physical repositories. A graph-based representation is an implementation option.¶
Physical AI Object (PAO): An object that is capable of moving with an AI agent, power source, and wireless communication capability (e.g., 5G Vehicle-to-Everything (V2X)). A PAO can be an intelligent Internet-of-Things (IoT) Device, Software-Defined Vehicle (SDV) [AUTOSAR-SDV][Eclipse-SDV][COVESA], Unmanned Aerial Vehicle (UAV), or Urban Air Mobility (UAM).¶
This section specifies an Agentic AI System for AI Service Management in target domains, as shown in Figure 1. In this figure, a human user (e.g., network administrator, building manager, and home user) uses a User System (e.g., smartphone and computer) for managing networks, security, and AI services. The User System interacts with a Cloud System or an Edge System for the human user's intents. A Cloud System manages multiple Edge Systems for the sake of human users. An Edge System manages multiple Devices for networks, security, and AI services like in Figure 1. The devices are Physical AI Objects (PAOs) having at least one AI agent for the interaction with an Edge Agent and the AI agents (called Worker AI Agents) of other PAOs.¶
User System
+------------+
| User Agent |
+------------+
^ ^
| A2A | A2A
| V
Edge System V Cloud System
****************************************** **********
* * * *
* * * +----------+ *
* +-----------------+ * * | Cloud | *
* | Edge Agent | *<->* | Agent | *
* +--------^--------+ *A2A* +----------+ *
* | * * *
* V * * *
****************************************** **********
^ ^ ^
| A2A | A2A | A2A
V V V
+----------------+ +----------------+ +----------------+
| +------+ | | +------+ | | +------+ |
| |Worker| | | |Worker| | | |Worker| |
| |Agent1| |<-->| |Agent2| |<-->| |Agent3| |
| +---^--+ |A2A | +---^--+ |A2A | +---^--+ |
| | MCP | | | MCP | | | MCP |
| +--V----+ | | +--V----+ | | +--V----+ |
| |Modules| | | |Modules| | | |Modules| |
| +-------+ | | +-------+ | | +-------+ |
+----------------+ +----------------+ +----------------+
Device1 Device2 Device3
<----> Wired/Wired Link
Figure 2 shows an Agentic AI Framework for the management in networks, security, and AI services. A User Agent in the User System generates an intent for the human user's service demand and sends it to either a Cloud System or an Edge System. Either a Cloud Agent in the Cloud System or an Edge Agent in the Edge System receives the intent from the User Agent.¶
In the case where the Cloud Agent receives an intent from the User Agent, the Cloud Agent translates the intent into the corresponding high-level policy through its Intent Translator. For the authentication and authorization of a User Agent, the User Agent in the User System needs to contact the Cloud Agent in the Cloud System. This security process is necessary for the management of networks, security, and AI services at the target domains where the User Agent has an access permission. This is different from the assumption that an AI agent can discover other AI agents to help its task like travel agents to reserve airplane tickets, hotel rooms, and local transportation tickets.¶
<User System>
+----------------------+
| User Agent |
|(Smartphone, Computer)|
+----------------------+
^ | ^
| | Intent | Report
| v | <Cloud System>
| +-----------------------------------------------------------------+
| | +-------------------+ Agent Information +-------------------+ |
| | | Cloud Agent |<------------------->| Knowledge Base | |
| | |(Intent Translator)| | (Agent Catalog) | |
| | +-------------------+ +-------------------+ |
| +-----------------------------------------------------------------+
| ^ ^
| Intent | Intent (Report) | Agent Card
V(Report) v <Edge System> V
+-----------------------------------------------------------------+
| +-------------------+ Agent Information +-------------------+ |
| | Edge Agent |<------------------->| Knowledge Base | |
| |(Intent Translator)| | (Agent Catalog) | |
| +-------------------+ +-------------------+ |
+-----------------------------------------------------------------+
^ ^
| Intent (Report) | Agent Card
v <Devices with Worker Agent> V
+---------------------------------------------------------------------+
| <Device1> <Device2> <Device3> |
| +------------------+ +----------------------+ +-----------------+ |
| | Worker Agent1 | | Worker Agent2 | | Worker Agent3 | |
| |(Router, Switch) | |(Firewall, Web Filter)| |(Robot, SDV, IoT)| |
| +------------------+ +----------------------+ +-----------------+ |
+---------------------------------------------------------------------+
Each Cloud or Edge Agent accesses the Knowledge Base through a repository access interface. Its Intent Translator retrieves domain-specific schemas, policy examples, and semantic constraints from the policy-knowledge part of the Knowledge Base to support policy generation and validation. The Agent Catalog provides Agent Cards for candidate Worker Agent lookup. The Knowledge Base supplies information for intent translation and enforcement such as the intent translation, policy validation, and Worker Agent selection.¶
A policy-knowledge role is used to translate an intent into a specific intent with the Policy Knowledge Base in [I-D.gu-nmrg-intent-translator]. Both the integration with an Agent Catalog and the use of catalog information for Worker Agent selection are architectural extensions. Policy schemas and semantic constraints are supplied for each supported domain. The data models (e.g., XML [W3C.REC-xml-20081126], JSON [RFC8259], and YAML [YAML] documents) with constraints for the AI service management need to be developed.¶
Once the User Agent is authenticated and authorized through the Cloud Agent, the User Agent can interact with an Edge Agent in an Edge System that can handle the User Agent's intent with its Work Agents, as shown in Figure 2.¶
When the Edge Agent receives a high-level policy from the Cloud Agent, it refines that policy into one or more specific intents for Worker Agents. When it receives a natural-language intent directly from the User Agent, its Intent Translator first generates a structured high-level policy, which is then refined in the same way. Each specific intent represents a worker-specific goal or policy and may be serialized as an XML, JSON, or YAML document according to its target model. Within this framework, the Intent Translator queries the Agent Catalog to obtain candidate Agent Cards and evaluates their suitability for the requested task. Policy refinement and Worker Agent selection are extensions introduced by this document. Refinement preserves the goals and constraints of the original intent.¶
The Edge Agent sends the specific intents to the selected Worker Agents to enforce the requested service corresponding to the intent from the User Agent.¶
When a Worker Agent receives a specific intent, it performs the requested service using its internal resources and external resources via MCP with predefined APIs.¶
Operation results (e.g., success, failure, alarm, and event) for the given intent are delivered as reports from a source component (e.g., Worker Agent, Edge Agent, and Cloud Agent) to a destination component (e.g., Edge Agent, Cloud Agent, and User Agent) in the Agentic AI Framework in Figure 2.¶
Note that the agent discovery can be performed in the following two approaches. The first approach is a reactive way using an agent discovery protocol (e.g., DNS and mDNS) [I-D.seethiraju-dawn-dan][I-D.zhang-dawn-agent-discovery-framework]. The second approach is a proactive way (e.g., a capability registration protocol) [I-D.ietf-i2nsf-capability-data-model][I-D.ietf-i2nsf-registration-interface-dm][I-D.ietf-i2nsf-applicability]. The agent discovery is out of scope of this document.¶
Interfaces in the Agentic AI Framework use A2A [A2A-Specification] and MCP [MCP-Specification]. The interfaces among the User Agent, the Cloud Agent, the Edge Agent, and the Worker Agents use A2A, as shown in Figure 1. The interfaces among agents and modules in each system (e.g., User Agent, Cloud Agent, Edge Agent, and Worker Agent) use MCP, as shown in Figure 1.¶
This document does not require any IANA actions.¶
Authentication and authorization mechanisms should be used to check the validity of User Agents. For trustworthy cooperation, mutual authentication should be performed beforehand among the Cloud Agent, the Edge Agents, and Worker Agents.¶
An intent from a User Agent should be evaluated by either the Cloud Agent or the Edge Agent to determine whether it is harmless to the Agentic AI Framework or not. If the intent is harmful, either the Cloud Agent or the Edge Agent should log this intent and report the harmfulness of the intent to the User Agent which issued the intent.¶
For reliable and agile AI services, the Agentic AI Framework should perform governance by monitoring and auditing the activities of AI agents including the User Agent, Cloud Agent, Edge Agents, and Worker Agents. Such an auditing system may operate as an independent entity in the Agentic AI Framework so that it can audit the AI agents without any bias.¶
This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT) (No. RS-2024-00398199).¶
This document is made by the group effort of OPWAWG, greatly benefiting from inputs and texts by Linda Dunbar (Futurewei), Yong-Geun Hong (Daejeon University), and Joo-Sang Youn (Dong-Eui University). The authors sincerely appreciate their contributions.¶
The following are coauthors of this document:¶