| Internet-Draft | AI Agent Architecture for NDT | November 2026 |
| Zhao, et al. | Expires 6 May 2027 | [Page] |
This document proposes an AI agent architecture for Network Digital Twin (NDT) that enables collaborative reasoning, simulation-assisted decision-making, and closed-loop network operations.¶
The architecture integrates specialized AI agents into the core NDT components and introduces mechanisms for twin validity assessment, evidence-based decision-making, and policy-controlled execution.¶
It further describes multi-agent coordination, simulation evidence exchange, and feedback-driven model evolution to improve the reliability and adaptability of AI-assisted network management.¶
The document also identifies research challenges and potential interoperability requirements for integrating AI agents with NDT-based network management systems.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 6 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Digital twins have emerged as a powerful paradigm for network management, providing virtual representations of physical networks that enable simulation, analysis, and optimization. However, traditional digital twin architectures often lack the autonomous decision-making capabilities needed for modern network environments. This document proposes an architecture that combines digital twin concepts with intelligent AI agents, creating a more dynamic and responsive network management system.¶
The proposed architecture builds upon the existing NDT reference architecture and introduces AI-agent capabilities into its functional components. It enables distributed reasoning, adaptive model management, and collaborative decision-making while preserving the fundamental separation between the physical network and its digital representation.¶
However, the integration of AI agents and NDT introduces several research challenges. First, AI agents may make decisions based on incomplete, inconsistent, or outdated digital twin states. Second, simulation results produced by heterogeneous NDT models may lack a common representation for verification and exchange. Third, independently operating agents may generate conflicting actions that affect shared network resources.¶
To address these challenges, this document focuses on twin-state validity, evidence-based simulation and verification, multi-agent coordination, and bounded autonomous execution. These capabilities provide a foundation for investigating reliable AI-assisted network operations using NDT.¶
This document complements existing work on Agentic AI-based network operations by focusing specifically on the validity and evidence requirements of NDT-assisted agent decisions, rather than defining another general-purpose agent orchestration framework.¶
Based on the concept of the Network Management Agent (NMA) [I-D.zhao-nmop-network-management-agent], this document proposes an AI Agent architecture for Network Digital Twin (NDT) [I-D.irtf-nmrg-network-digital-twin-arch].¶
The architecture integrates specialized AI agents into four logical NDT components: the NDT Management Agent, Functional Model Agent, Basic Model Agent, and Data Repository Agent. These agents collaboratively perform network state analysis, model construction, simulation, and task planning.¶
To support reliable autonomous operations, the architecture further introduces an NDT Assurance and Action Gate as a logical decision boundary between AI-generated plans and physical network execution.¶
The Action Gate evaluates the validity of the NDT state, simulation evidence, operational constraints, and authorization policies before an AI-generated action is submitted to an existing network controller.¶
This separation enables AI agents to perform flexible reasoning and planning while preserving deterministic policy enforcement and controlled execution through existing network management mechanisms.¶
+------------------------------------------------------------------+
| Network Digital Twin Management AI Agent |
| |
| - Resource Monitoring & NDT Lifecycle Management |
| - Intent Parsing & Policy Derivation |
| - Multi-Agent Task Orchestration |
| - Risk Assessment & Approval Coordination |
+--------------------------------+---------------------------------+
|
Task Orchestration
|
+-----------------+------------------+
| |
v v
+------------------------------+ +------------------------------+
| Functional Model Agent | | Basic Model Agent |
| | | |
| - Service Model Optimization |<->| - Network Element Models |
| - Configuration Synthesis | | - Topology & Connectivity |
| - Multi-Level Simulation | | - Network State Updates |
| - Simulation Evidence (SER) | | - Twin Validity (TVC) |
+---------------+--------------+ +---------------+--------------+
| |
| |
+----------------+-----------------+
|
v
+--------------------------------------+
| Data Repository AI Agent |
| |
| - Telemetry & Historical Data |
| - Knowledge Base Management |
| - Data Provenance & Consistency |
| - TVC / SER Storage & Retrieval |
+------------------+-------------------+
|
Candidate Action & Evidence
|
v
+--------------------------------------+
| NDT Assurance and Action Gate |
| |
| - Twin Validity Assessment |
| - Simulation Evidence Verification |
| - Policy & Authorization Checks |
| - Execution Admission Decision |
+------------------+-------------------+
|
Authorized Action
|
v
+--------------------------------------+
| Existing Network Controller |
+------------------+-------------------+
|
v
+--------------------------------------+
| Physical Network |
+------------------+-------------------+
|
Telemetry / Observations
|
Feedback to Basic Model and
Data Repository AI Agents
Figure 1 illustrates the logical architecture of the proposed AI Agent-based NDT system. The four AI agents collaborate on network management tasks, including intent processing, network modeling, simulation, and data management.¶
The Functional Model Agent generates simulation evidence, while the Basic Model Agent provides information about the validity of the NDT state. The Data Repository Agent maintains the associated data and evidence.¶
The NDT Assurance and Action Gate evaluates candidate actions against the available simulation evidence, twin validity information, and operational policies before execution through an existing network controller.¶
The Management Agent coordinates the overall process and submits candidate actions for evaluation. Observations from the physical network are used to update the NDT models and support subsequent verification.¶
The Network Digital Twin Management Agent serves as the central coordination and management component, providing the following key functionalities:¶
Resource Monitoring: Continuously tracks and monitors the status, performance metrics, and operational health of all resources within the digital twin environment.¶
Lifecycle Management: Governs the complete lifecycle of NDT instances, encompassing instantiation, configuration, state synchronization, maintenance, and termination.¶
Session Control: Orchestrates communication sessions and interactions among various AI agents to ensure coherent operation.¶
Intent Translation & Policy Derivation: Translates high-level business intents into candidate operational objectives and policies while identifying conflicts with existing network constraints.¶
Virtual-Physical Synchronization Control: Coordinates state synchronization between the NDT and the physical network and identifies potential inconsistencies or synchronization delays.¶
Risk-Aware Task Orchestration: Classifies operational tasks according to their potential network impact, required validation coverage, and permitted autonomy level.¶
Evidence-Based Decision Coordination: Collects simulation evidence and twin validity information from other agents and submits candidate actions to the NDT Assurance and Action Gate.¶
Human-in-the-Loop Coordination: Requests operator approval for high-risk operations or situations in which the available simulation evidence is insufficient.¶
Task Lifecycle Management: Tracks the state of an operational task from intent interpretation and simulation to execution, verification, and completion.¶
The Functional Model Agent is responsible for advanced service modeling, configuration generation, and optimization. It autonomously invokes required functional models per validation policie and refines them via historical data analysis.¶
Service Model Optimization: Refines models through performance analysis and adaptive learning algorithms.¶
Automated Configuration Synthesis: Generates vendor-specific configurations or intermediate policy representations based on the intent model.¶
Hierarchical Simulation Sandbox: Provides a multi-stage environment to verify configurations across compliance, logic, and business impact layers.¶
The Functional Model Agent produces machine-processable simulation evidence for candidate network operations. Each simulation is associated with an identified NDT state, a candidate action, and a set of explicit validation objectives.¶
The generated Simulation Evidence Record (SER) contains the following information elements:¶
Task Identifier: Identifies the network management task associated with the simulation.¶
Candidate Action Identifier: Identifies the proposed configuration or operational change.¶
Twin State Reference: Identifies the NDT snapshot used during simulation.¶
Model Information: Records the functional models and versions used.¶
Validation Scope: Describes the network resources, services, and constraints covered by the simulation.¶
Verification Results: Records the outcome of individual validation checks, including passed, failed, inconclusive, or untested conditions.¶
Predicted Impact: Describes expected changes to relevant network performance indicators.¶
Evidence Limitations: Identifies assumptions, missing data, and scenarios that could not be verified.¶
The SER is provided to the NDT Management Agent and the NDT Assurance and Action Gate to support evidence-based evaluation of candidate actions.¶
The SER is a candidate information model for interoperability research. This document does not define a protocol encoding or assume that successful simulation guarantees safe physical-network execution.¶
The Basic Model Agent maintains fundamental representations of network elements, topology, connectivity, configuration, and operational state. It continuously updates these models based on observations from the physical network.¶
In addition to maintaining digital models, the Basic Model Agent provides Twin Validity Assessment capabilities to characterize whether the available NDT state is suitable for a specific network management task.¶
The assessment considers the following dimensions:¶
State Freshness: The time elapsed since relevant physical network states were observed.¶
Data Completeness: The coverage of required network elements, topology relationships, and operational attributes.¶
State Consistency: The consistency of observations collected from different network devices and data sources.¶
Model Fidelity: The observed differences between NDT predictions and physical network behavior for supported scenarios.¶
Scenario Applicability: The extent to which the available NDT models cover the network conditions and behaviors required by a particular task.¶
The Basic Model Agent exposes a Twin Validity Context (TVC) associated with the NDT snapshot. The TVC includes the relevant state references, observation timestamps, model versions, assessment results, and known limitations.¶
When the physical network materially changes after a simulation has been completed, the Basic Model Agent can notify the NDT Management Agent that the associated simulation evidence may require revalidation.¶
The Data Repository AI Agent serves as the intelligent data governance and provisioning component. It autonomously manages the data lifecycle with the following capabilities:¶
Real-time Data Collection: Implements multi-protocol ingestion for streaming telemetry while autonomously detecting data anomalies.¶
Historical Data Intelligence: Curates structured data and knowledge graphs to support pattern mining, and model training.¶
Adaptive Data Services: Provides context-aware data retrieval with intelligent caching and conflict resolution.¶
Knowledge Base Integration: Stores network configurations, vendor documents, and best practices to support incremental model updates.¶
Evidence Repository: Stores Simulation Evidence Records (SERs), Twin Validity Contexts (TVCs), and the associated task and model identifiers.¶
Data Provenance Management: Maintains information about data sources, observation timestamps, collection methods, and model versions to support traceability and reproducibility.¶
Evidence Correlation: Associates simulation results with the corresponding NDT snapshots, candidate network actions, and physical network observations.¶
Evidence Consistency Checking: Identifies missing, inconsistent, or outdated information that may affect the validity of simulation results.¶
Feedback Data Management: Records differences between predicted and observed network behavior to support subsequent model calibration and evaluation.¶
The architecture supports logical Agent-to-Agent (A2A) interactions among the NDT Management Agent, Functional Model Agent, Basic Model Agent, and Data Repository Agent.¶
These interactions enable task delegation, context sharing, model invocation, simulation result exchange, and coordinated decision-making.¶
Each operational task is associated with a task identifier, and candidate actions are correlated with the NDT snapshots and simulation evidence used during their evaluation.¶
Before a candidate action is submitted for execution, the Management Agent coordinates the detection of potential conflicts among agents, including conflicting operational objectives, overlapping network resources, incompatible configuration changes, and inconsistent NDT states.¶
When conflicting actions are detected, the Management Agent may request additional simulation, action serialization, plan revision, or operator intervention.¶
A2A-style mechanisms may support communication between agents, while MCP-style mechanisms may expose NDT modeling and simulation capabilities as callable tools. The choice of transport and protocol is implementation-specific.¶
Inter-agent coordination does not grant an agent authority to modify the physical network. Network changes remain subject to the NDT Assurance and Action Gate and the authorization mechanisms of the existing network controller.¶
A failed simulation or intent decomposition may require restoration of the virtual state. Such restoration does not imply that changes already applied to the physical network can be automatically rolled back.¶
This use case demonstrates how the AI Agent architecture automates the end-to-end lifecycle of network configuration.¶
Intent Parsing: The Management Agent receives declarative intents, identifying network objects and resolving logical conflicts between multiple intents.¶
Config Generation: The Functional Model Agent produces vendor-specific configurations. It maintains context awareness by retrieving current states from the Basic Model Agent.¶
Vendor-agnostic Abstraction: The system uses an intermediate policy representation to ensure functional consistency across heterogeneous hardware.¶
Before a candidate configuration is submitted for deployment, the architecture applies a multi-stage validation process that combines configuration verification, NDT-based simulation, and evidence-based execution admission.¶
The validation process includes:¶
Configuration and Policy Validation: Checks configuration syntax, schema compliance, and consistency with applicable network policies and intent constraints.¶
Functional Verification: Uses NDT functional models to evaluate network reachability, routing behavior, protocol convergence, and other task-specific functional requirements.¶
Service Impact Assessment: Estimates the potential effects of the candidate action on service availability, network capacity, latency, and other relevant performance indicators.¶
Twin Validity Assessment: Evaluates whether the NDT snapshot and models used for simulation satisfy the validity conditions required by the task.¶
Evidence-Based Admission: Evaluates the Simulation Evidence Record against policy constraints and the permitted execution scope.¶
Pre-Execution State Revalidation: Checks whether relevant physical network conditions have changed since the simulation was performed.¶
Validation results are recorded as passed, failed, inconclusive, or not tested. A successful simulation does not automatically authorize deployment.¶
When the available evidence is incomplete, the NDT state has become outdated, or the candidate action exceeds the permitted autonomy level, the architecture may request additional simulation, plan revision, or operator approval before execution.¶
Closed-loop Optimization: If verification fails, the Management Agent feeds error reports back to the generation models of the Functional Model Agent for iterative optimization.¶
Incremental Learning: Experts can manually correct AI outputs, which are stored in the Data Repository Agent to fine-tune future generation and verification models.¶
The architecture supports NDT-assisted network cutover planning, simulation, and post-execution verification.¶
During the planning phase, the NDT Management Agent coordinates the decomposition of the cutover task into ordered operational steps, while the Functional Model Agent evaluates alternative execution sequences and failure scenarios.¶
Each candidate cutover plan is evaluated against an identified NDT snapshot. The simulation results include expected service impact, network state transitions, resource dependencies, and potential failure conditions.¶
Before executing a high-impact cutover step, the NDT Assurance and Action Gate evaluates the associated simulation evidence and verifies whether the relevant network conditions remain valid.¶
During execution, physical network telemetry is compared with the predicted NDT behavior. When significant divergence is detected, the Management Agent may suspend subsequent steps and invoke operator-defined contingency procedures.¶
The differences between predicted and observed outcomes are recorded by the Data Repository Agent to support future NDT model calibration and improvement.¶
The proposed architecture introduces several issues that require further investigation.¶
One issue is the consistency between the NDT state and the physical network. Network topology, configuration, and operational data may be collected at different times. Changes in the physical network may therefore invalidate the assumptions used in an earlier simulation. It is necessary to determine what information should be maintained to assess the validity of an NDT snapshot, and under what conditions a simulation needs to be repeated.¶
Another issue concerns the interpretation of simulation results across different agents and functional models. A successful simulation may cover only part of the network or a limited set of failure scenarios. The Twin Validity Context (TVC) and Simulation Evidence Record (SER) described in this document are intended to make such limitations explicit. The minimum information required for these records and their relationship to existing network management data models needs further investigation.¶
These issues can be examined through network configuration and cutover scenarios. For example, a candidate configuration may first be evaluated against an NDT snapshot; after that, the physical network may change prior to deployment. Comparing the results with and without NDT state revalidation would help assess whether the proposed mechanism can identify outdated simulation results.¶
The evaluation should consider both the effectiveness of detecting invalid conditions and the additional overhead introduced by state synchronization and verification. In particular, unnecessary revalidation may increase operational latency without improving the outcome. The trade-off between validation accuracy and operational efficiency remains an area for further study.¶
AI-Generated Risks: Specific checks must be implemented to detect "hallucinated" commands or non-compliant security policies generated by large language models. These checks are separate from the NDT Assurance and Action Gate validation, as hallucination may occur before simulation.¶
TBD.¶