Considerations for Agent Gateway Integration within the DAWN Framework

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 6 May 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

The rapid proliferation of artificial intelligence entities, autonomous workloads, specialized datasets, and compute resources has highlighted a fundamental architectural challenge in modern network infrastructure: how can an autonomous agent discover another agent or discover a specific capability situated behind an administrative boundary in a secure, privacy-preserving, and interoperable manner?¶

As described in the DAWN Problem Statement and established in the IETF DAWN Working Group Charter, current discovery methods are heavily fragmented. Existing systems rely on proprietary directories, static IP configurations, or localized name lookups that fail to scale across administrative trust boundaries, cannot express dynamic entity attributes (such as real-time compute load or availability status), and lack standardized mechanisms for discovering sub-agents operating within private local networks behind Network Address Translation (NAT) and firewalls.¶

The DAWN framework establishes a high-level lifecycle for interacting entities, spanning identity provisioning, authentication, authorization, access to a Discovery Substrate via an Access Point, peer-to-peer invocation, and continuous monitoring. However, realizing this lifecycle across heterogeneous networks requires a concrete middleware component capable of bridging local domain mechanisms with wide-area discovery fabrics.¶

The Agent Gateway (AGW) serves as that essential universal infrastructure component. Operating at the boundary of administrative domains, the Agent Gateway acts primarily as a Dual-Directional Discovery Proxy:¶

1. Outbound Discovery Proxy (Access Point Mode): Assisting resource-constrained or domain-internal agents in querying wide-area DAWN discovery substrates, resolving remote agent endpoints, and verifying peer credentials without requiring every local node to implement complex wide-area discovery protocols.¶

2. Inbound Domain Discovery Proxy (Aggregator/Broker Mode): Receiving external DAWN discovery queries, evaluating query parameters against an internal Local Agent Registry, performing capability matching for sub-agents situated behind the gateway, and exporting an aggregated Minimum Discoverable Information (MDI) descriptor. This mechanism enables external agents to discover matching sub-agent capabilities while shielding internal network topologies, sub-agent IP addresses, and private domain architecture.¶

2. Terminology and Conceptual Mapping

This document aligns with the core terminology established in the DAWN problem space and the Agent Gateway functional specifications. Key terms include:¶

• Agent Gateway (AGW): A logical or physical middleware gateway deployed at domain boundaries or central management hubs, responsible for cross-domain trust, protocol translation, task routing, and capability discovery.¶

• Discovery Substrate: The underlying distributed framework or federation protocol through which discoverable objects are registered, indexed, searched, and resolved.¶

• Discoverable Object: The formal descriptor (such as an Agent Card or Task Card) exposed by an entity or gateway to represent its capabilities, requirements, or endpoints within the discovery substrate.¶

• Minimum Discoverable Information (MDI): The standardized minimal payload structure embedded in a Discoverable Object, containing essential identity, skill schemas, security requirements, dynamic health metrics, and communication URIs necessary for remote entities to determine interaction suitability.¶

• A2A Gateway: The AGW functional sub-module dedicated to inter-agent protocol translation, authentication, task lifecycle management, P2P NAT traversal, and skill routing.¶

• Network Gateway: The AGW functional sub-module handling transport-layer connectivity, STUN/TURN/ICE P2P traversal, link failover, and quality-of-service (QoS) management.¶

3. Dual-Directional Discovery Proxy Architecture and Operational Modes

The following diagram below illustrates the dual-directional discovery proxy architecture of the Agent Gateway within the DAWN framework:¶

+-----------------------------------------------------------------------------------+
|                            DAWN Wide-Area Discovery Substrate                     |
+-----------------------------------------------------------------------------------+
            ^                                                   ^
            | [Mode A: Outbound Discovery Proxy]                | [Mode B: Inbound Domain Discovery Proxy]
            | (Discovers External Entities for Local Agents)    | (Receives Inbound Queries, Matches Sub-Agents)
            v                                                   v
+-----------------------------------------------------------------------------------+
|                              Agent Gateway (AGW)                                  |
|   +---------------------------------------------------------------------------+   |
|   |  - Local Agent Registry (Internal Agent Capability Registry)              |   |
|   |  - Capability Matcher & Attribute Indexer (Capability Matcher Engine)     |   |
|   |  - Selective MDI Aggregator (Selective Disclosure & Masking)              |   |
|   +---------------------------------------------------------------------------+   |
+-----------------------------------------------------------------------------------+
            ^                                                   ^
            | (LAN Lightweight Registration & Query)            | (Internal Gateway Routing & Obfuscation)
            v                                                   v
+--------------------------+                             +--------------------------+
| Requesting Agent (Intra) |                             |   Matched Sub-Agent B    |
|  (e.g., Vehicle Agent)   |                             |  (e.g., Internal HVAC)   |
+--------------------------+                             +--------------------------+

+-------------------+        +-------------------------+        +-------------------+        +---------------------+
| Local Sub-Agent A |        | Local AGW (Domain A)    |        | Wide-Area DNS     |        | Remote AGW          |
|  (Requesting)     |        | (Discovery Access Point)|        | Server (DNS-SD)   |        | (Domain B)          |
+-------------------+        +-------------------------+        +-------------------+        +---------------------+
          |                               |                               |                             |
          | (1) POST /local-discovery     |                               |                             |
          |     (Query: logistics_skill)  |                               |                             |
          |------------------------------>|                               |                             |
          |                               | (2) Unicast DNS-SD Query      |                             |
          |                               |     _dawn-agw._tcp.domain.org |                             |
          |                               |------------------------------>|                             |
          |                               |<------------------------------|                             |
          |                               | (3) PTR, SRV, TXT Answer      |                             |
          |                               |                               |                             |
          |                               | (4) Out-of-band Fetch MDI     |                             |
          |                               |     GET /.well-known/agent.json                             |
          |                               |------------------------------------------------------------>|
          |                               |<------------------------------------------------------------|
          |                               | (5) Full MDI Descriptor       |                             |
          |                               |                               |                             |
          |                               | (6) Validate Provenance & Cert|                             |
          | (7) Return Filtered Candidates|                               |                             |
          |<------------------------------|                               |                             |

+------------------+         +-----------------------+         +---------------------+         +----------------------+
| External Agent   |         | Target AGW (Domain B) |         | Local Agent Registry|         | Internal Sub-Agent B |
|   (Domain A)     |         |                       |         |                     |         |                      |
+------------------+         +-----------------------+         +---------------------+         +----------------------+
         |                               |                                |                               |
         |                               |<===============================|===============================| (0) Intra-domain Register
         |                               |  Register (skill: hvac_control)|                               |     (schema, endpoint)
         |                               |------------------------------->|                               |
         |                               |  Store Sub-Agent Entry         |                               |
         |                               |                                |                               |
         | (1) Inbound DAWN Query:       |                                |                               |
         |   GET /.well-known/agent.json |                                |                               |
         |------------------------------>|                                |                               |
         |                               | (2) Match Skill                |                               |
         |                               |------------------------------->|                               |
         |                               |     Query: skill=hvac_control  |                               |
         |                               |<-------------------------------|                               |
         |                               | (3) Return Sub-Agent B Match   |                               |
         |                               |                                |                               |
         |                               | (4) Aggregate MDI & Mask IPs   |                               |
         | (5) Return Aggregated MDI     |                                |                               |
         |     (200 OK, Public Ingress)  |                                |                               |
         |<------------------------------|                                |                               |

4. Agent Gateway Roles in DNS-SD / mDNS Discovery

The IETF DAWN framework leverages the Domain Name System (DNS) and Multicast DNS (mDNS) as foundational transport mechanisms for initial AI resource locating. However, standard DNS infrastructures are inherently static, domain-unaware, and incapable of representing complex AI agent capability hierarchies, dynamic health metrics, or topology isolation policies. Within the DAWN discovery fabric, the Agent Gateway (AGW) serves as the essential intelligent mediation layer between AI entities and the underlying DNS/mDNS protocols.¶

When DNS-SD [RFC6763] and mDNS [RFC6762] are employed for DAWN discovery, the Agent Gateway fulfills four crucial architectural roles across local and wide-area networks:¶

+---------------------------------------------------------------------------------------+
|                             Wide-Area DNS (Unicast DNS-SD)                            |
|             _dawn-agw._tcp.example.com. IN PTR / SRV / TXT / A / AAAA                 |
+---------------------------------------------------------------------------------------+
                                           ^
                                           | Unicast DNS Updates / Resolution (WAN)
                                           v
+---------------------------------------------------------------------------------------+
|                               Agent Gateway (AGW)                                     |
|                                                                                       |
|  [ Role 1: LAN mDNS Responder ]    <--->  Local Multicast mDNS (UDP 5353, .local)     |
|  [ Role 2: WAN DNS-SD Aggregator ] <--->  Authoritative DNS Zone Management           |
|  [ Role 3: Outbound DNS Resolver]  <--->  Wide-Area DNSSEC & Policy Validation         |
|  [ Role 4: Dynamic TTL/MDI Adapter] <---> Two-Stage Filtering & Cache Control         |
|                                                                                       |
|  +---------------------------------------------------------------------------------+  |
|  | Local Agent Registry  | Capability Matcher Engine | Topology Masking Module    |  |
|  +---------------------------------------------------------------------------------+  |
+---------------------------------------------------------------------------------------+
      ^                                                                         ^
      | Intra-Domain Registration / Query                                       | Direct Inbound Discovery
      v                                                                         v
+-----------------------+                                       +-----------------------+
| Internal Sub-Agents   |                                       | External Requesters   |
| (HVAC, Security, etc) |                                       | (Remote Agents / AGW) |
+-----------------------+                                       +-----------------------+

1. Local LAN mDNS Proxy Registrar & Responder:¶

   • Problem: Lightweight or specialized internal sub-agents (e.g., embedded sensors, HVAC controllers, micro-agents) often lack full mDNS/DNS-SD protocol stacks or cannot safely participate in LAN multicast traffic.¶

   • AGW Role: The AGW runs an internal mDNS Responder (listening on UDP port 5353). As internal sub-agents register their skills with the gateway's Local Agent Registry, the AGW automatically proxies and announces their capabilities on the local subnet under the .local domain. When local peers query for available capabilities, the AGW responds on behalf of all internal sub-agents, eliminating the need for every micro-agent to host a standalone mDNS daemon.¶

2. Wide-Area DNS-SD Authoritative Aggregator & Topology Masking Proxy:¶

   • Problem: Directly publishing individual sub-agent hostnames, private IP addresses, or internal port numbers into public DNS zones creates severe security vulnerabilities, leaks network topology, and fails for nodes situated behind NATs.¶

   • AGW Role: The AGW acts as an authoritative DNS-SD aggregator for wide-area domain zones (e.g., _dawn-agw._tcp.example.org). Instead of exposing individual sub-agents, the AGW aggregates internal skill schemas into a unified gateway descriptor. It registers itself as the sole public SRV target and A/AAAA endpoint, completely shielding internal sub-agent IP addresses, host counts, and network topologies from WAN inspection.¶

3. Outbound DNS Discovery Proxy & Safety Filter:¶

   • Problem: Internal sub-agents seeking external services often lack the complexity to perform multi-stage DNS-SD PTR/SRV/TXT parsing, validate DNSSEC cryptographic provenance, or enforce domain security policies.¶

   • AGW Role: The AGW serves as an outbound DNS resolution proxy. A local sub-agent issues a simplified discovery request to the gateway; the AGW executes unicast DNS-SD queries across wide-area DNS servers, validates DNSSEC signatures, verifies remote gateway certificate chains, filters out unverified or malicious endpoints, and returns a sanitized list of verified remote targets to the local requester.¶

4. Dynamic Attribute Adapter & DNS TTL Cache Manager:¶

   • Problem: Standard DNS infrastructures are optimized for static or slow-changing resource records, whereas AI agents exhibit highly dynamic operational states (e.g., real-time CPU/memory load, instant availability status, dynamic skill enablement). Storing rapidly changing metrics directly in DNS causes record thrashing, excessive DNS traffic, and stale caching issues.¶

   • AGW Role: The AGW reconciles standard DNS caching mechanics with dynamic AI agent states by enforcing a strict separation:¶

     • Static / Semi-Static Attributes (Skill IDs, protocol versions, authentication methods, domain endpoints) are mapped into DNS-SD TXT records with moderate TTL values (120s - 300s).¶

     • Highly Dynamic Metrics (real-time load, queue depth, precise memory availability) are excluded from DNS records and served dynamically during the Stage 2 out-of-band HTTPS MDI query, ensuring DNS records remain stable while real-time state remains accurate.¶

5. Scope Alignment: Agent Gateway Architecture vs. IETF DAWN Charter Scope

To ensure strict compliance with IETF standardization boundaries, the table and text below delineate which Agent Gateway functions fall directly within the IETF DAWN Working Group Charter scope and which represent out-of-scope downstream middleware functions.¶

6. Technical Resolution Matrix: DAWN Challenges vs. AGW Interventions

The DAWN Problem Statement [I-D.akhavain-moussa-dawn-problem-statement] identifies six fundamental challenges facing internet-scale discovery. The table below details how the Agent Gateway architecture resolves each challenge during the discovery phase:¶

7. Security Considerations

As the single ingress and egress boundary for cross-domain multi-agent discovery, the Agent Gateway MUST enforce strict security and privacy protections compliant with IETF guidelines:¶

• Transport Security: All external discovery interfaces MUST require TLS 1.3 encryption [RFC8446]. Plaintext HTTP or unencrypted DNS queries over untrusted public networks MUST be upgraded to DoT (DNS over TLS, [RFC7858] or DoH (DNS over HTTPS, [RFC8484]).¶

• Anti-Poisoning & Authority Validation: AGWs MUST validate DNSSEC signatures for unicast DNS-SD records and verify OAuth 2.0 / JWT domain signatures to prevent malicious third parties from injecting toxic discovery responses.¶

• Selective Disclosure & Mutual Privacy: Conforming to [RFC6973] and DAWN privacy requirements, AGW implements selective disclosure. The gateway conceals internal sub-agent counts, private IP topologies, and hardware specifications, returning only aggregated MDI descriptors. Simultaneously, discovery queries digest requester identity to limit intent tracking.¶

• Human-in-the-Loop (HITL) Out-of-Band Safety: High-risk operations discovered via MDI (marked with require_human_approval: true) MUST cause downstream execution engines to suspend task processing and push verification requests to the domain owner's authenticated device via an isolated push channel.¶

• Tamper-Proof Audit Logging: AGW components MUST record structured audit logs for all cross-domain discovery queries and capability lookups, capturing timestamp, issuer identity, target skill ID, and authorization scope.¶

8. Appendix: Use Cases and Deployment Scenarios

To provide practical guidance for implementers, this section details three representative deployment use cases focusing specifically on discovery workflows.¶

9. IANA Considerations

TBC¶

10. References

Authors' Addresses