Agentic AI: Relevant IETF Standards & Drafts

Curated list of published RFCs and Internet-Drafts relevant to agentic AI standardization. Organized by problem domain. Curated snapshot 2 September 2026. Draft status is checked against the datatracker four times a day.

AI authorship signals for individual submissions, by 4-model consensus: clear no significant signals review some flags noted flagged multiple converging signals n/a not retrievable — consensus of Claude Sonnet 4.5, Haiku 4.5, Opus 4.6, and GPT-4o over deterministic heuristics + LLM. Click badge for full analysis.

Checked against datatracker 2 September 2026: 36 new versions, 11 expired, 4 replaced since the last update.

Identity and Authentication

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 7519	JSON Web Token (JWT)	RFC identity	The token format for WIMSE workload credentials, workload proof tokens, transaction tokens, and identity chaining. Foundation of the agent credential stack.
RFC 9421	HTTP Message Signatures	RFC security	WebBotAuth and WIMSE HTTP signatures both profile this standard. Signs HTTP requests for workload-to-workload and agent-to-service authentication.
RFC 8705	OAuth 2.0 Mutual-TLS Client Authentication	RFC security	SPIFFE client auth and workload-to-workload mTLS build on this. Certificate-bound access tokens for agent authentication.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-ietf-wimse-identifier ↑ -03	Rosomakho (Zscaler)	identity	Workload identifier with wimse: URI scheme. Bridges DNS-based resolution with local trust domains. Directly applicable to agent identity.	WG draft, rev -03.
draft-ietf-wimse-arch ↑ -08	Salowey et al.	identity	WIMSE architecture: workload vs workload instance definitions. Foundation for treating agents as workloads.	WG draft, rev -08.
draft-ietf-wimse-workload-creds ↑ -02	Campbell et al.	identity	Workload Identity Token (JWT) and Certificate (X.509). Credential formats for agent authentication.	WG draft, rev -02.
draft-ietf-wimse-wpt ↑ -02	Campbell et al.	security	Workload Proof Token: JWT proof-of-possession for HTTP requests. Agent-to-service auth.	WG draft, rev -02.
draft-ietf-wimse-http-signature ↑ -06	Sheffer, Salowey	security	HTTP Signatures profile for workload-to-workload auth. Signs full URI to prevent replay.	WG draft, rev -06.
draft-ietf-wimse-workload-identity-practices ↑ -06	Gulbrandsen et al.	identity	Workload identity practices: access credentials vs signed instance metadata for federation.	WG draft, rev -06. Passed WGLC, awaiting write-up.
draft-klrc-aiagent-auth	Kasselman (Defakto), Lombardo (AWS), Rosomakho (Zscaler), Campbell (Ping), Steele (OpenAI)	security	Comprehensive framework composing WIMSE + OAuth + SPIFFE for agent auth. Shows how existing standards apply, identifies gaps.	Presented at DISPATCH 125, no WG home yet. clear
draft-beyer-agent-identity-problem-statement	Beyer	identity	Problem statement for agent identity: the gap binding agents to authorizing humans, distinct from workload identity.	Individual, -00. review
draft-beyer-agent-identity-architecture	Beyer	identity	Architectural model for agent identity, ownership and delegation. Companion to the problem-statement draft.	Individual, -00. review
draft-singla-agent-identity-protocol	Singla	identity	AIP: DID-based decentralized identity, delegation, and capability authorization for AI agents.	Individual, rev -03. clear
draft-drake-agent-identity-registry	Drake	identity	Persistent verifiable registry for non-human principals (AI agents, robots) with stable identifiers.	Individual, rev -03. clear
draft-mw-spice-actor-chain replaced →	Prasad et al.	security	Verifiable Actor Chains: cryptographic delegation chain provenance for AI agents via OAuth Token Exchange.	Dispatched from SPICE to WIMSE. clear
draft-ni-wimse-ai-agent-identity expired	Ni et al.	identity	WIMSE applicability to agentic AI: independent agent identity distinct from the workload that hosts it.	Individual, rev -02. clear

Authorization and Delegation

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 6749	OAuth 2.0 Authorization Framework	RFC security	The baseline authorization framework. Every OAuth draft on this page extends it. Agents act as OAuth clients.
RFC 8414	OAuth 2.0 Authorization Server Metadata	RFC security	How agents programmatically discover OAuth endpoints (authorization, token, JWKS). Checked by agent-readiness scanners.
RFC 9728	OAuth 2.0 Protected Resource Metadata	RFC security	How agents discover what tokens a protected resource requires and which authorization servers to use. Checked by agent-readiness scanners.
RFC 8693	OAuth 2.0 Token Exchange	RFC security	Actor chains, transaction tokens, and identity chaining all use token exchange. Core mechanism for multi-agent delegation.
RFC 9449	OAuth 2.0 Demonstrating Proof of Possession (DPoP)	RFC security	Proof-of-possession for bearer tokens. Prevents token theft in agent-to-service flows. Referenced by the agent auth framework.
RFC 9396	OAuth 2.0 Rich Authorization Requests (RAR)	RFC security	Fine-grained, structured authorization details. Enables per-tool authorization when MCP servers act as OAuth resource servers.
RFC 7523	JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants	RFC security	Identity assertion grant and identity chaining use JWT bearer assertions. How agents present identity tokens to obtain access tokens.
RFC 9126	OAuth 2.0 Pushed Authorization Requests (PAR)	RFC security	Secure authorization request delivery via back-channel. Prevents request tampering in agent authorization flows.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-ietf-oauth-identity-chaining ↑ -17	Schwenkschuster, Kasselman, Campbell et al.	security	OAuth Identity and Authorization Chaining Across Domains: agents obtain access tokens across trust boundaries via JWT grants. Core mechanism in klrc-aiagent-auth framework.	IESG-approved, rev -17. Near publication.
draft-ietf-oauth-first-party-apps ↑ -04	Parecki	security	First-party apps grant: native app auth without browser redirect. Relevant where agents act as first-party clients.	WG draft, rev -04.
draft-ietf-oauth-transaction-tokens ↑ -11	Tulshibagwale et al.	security	Transaction Tokens: propagate identity and context across multi-agent call chains. Used by A2A profile.	WG draft, rev -11. In WGLC.
draft-ietf-oauth-attestation-based-client-auth ↑ -10	Looker et al.	security	Attestation-based client auth: backend-attested client instance authentication via JWT + PoP. Enables platform-verified agent identity.	WG draft, rev -10.
draft-ietf-oauth-client-id-metadata-document ↑ -02	Parecki	security	Client ID Metadata Document: self-published client metadata for agent registration without pre-registration.	WG draft, rev -02.
draft-ietf-oauth-security-topics-update ↑ -03	Luo et al.	security	OAuth Security BCP update: new attack vectors (Audience Injection, COAT) critical for multi-tenant agent ecosystems.	WG draft, rev -03.
draft-mw-oauth-actor-chain ↑ -01	Krishnan et al.	security	RFC 8693 actor-chain profiles for MCP/A2A/agentic deployments needing multi-hop delegation continuity.	Individual, -01. Announced on agent2agent. clear
draft-ietf-oauth-v2-1	Parecki (Okta) et al.	security	OAuth 2.1: the baseline authz framework agents will use. PKCE plain dropped, mix-up mitigation.	WG draft, rev -15.
draft-ietf-oauth-identity-assertion-authz-grant	Parecki (Okta)	security	Identity Assertion Grant: agents exchange identity tokens for access tokens across trust domains. Enterprise agent use case.	WG draft, rev -04.
draft-song-oauth-ai-agent-collaborate-authz	Song	security	Multi-AI agent collaboration authorization via OAuth.	Individual, presented at OAuth 125. review
draft-ietf-oauth-spiffe-client-auth	Johansen et al.	security	SPIFFE client auth for OAuth: bridges workload identity (SPIFFE/WIMSE) to OAuth token endpoints.	WG draft, rev -02.
draft-nelson-agent-delegation-receipts	Nelson	security	Delegation Receipt Protocol: pre-action signed Authorization Object capturing user intent and scope before an agent acts.	Individual, rev -10. Active. clear
draft-niyikiza-oauth-attenuating-agent-tokens	Niyikiza	security	Attenuating Authorization Tokens (AATs): task-scoped delegation with tool and argument constraints for agent calls.	Individual, rev -01. clear
draft-araut-oauth-transaction-tokens-for-agents	Raut et al.	security	Transaction Tokens extension carrying an `act` field for agent context propagation across multi-hop calls.	Individual, rev -02. review
draft-hartman-credential-broker-4-agents	Hartman	security	CB4A: credential-vaulting broker so agents never hold real long-lived creds; broker mints scoped tokens per task.	Individual, -00. clear
draft-kahrer-oauth-client-challenge-protocol	Kahrer (Curity)	security	Token-error-response challenge so an AS can re-validate an agent's current mandate before issuing a new token.	Individual, -00. clear
draft-zehavi-oauth-rar-metadata replaced →	Zehavi	security	RAR Metadata: MCP servers as OAuth resource servers advertising per-tool authorization details.	Presented at OAuth 125. clear

Agent Discovery and Naming

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 8615	Well-Known Uniform Resource Identifiers (URIs)	RFC discovery	The /.well-known/ mechanism underpinning MCP server cards, A2A agent cards, API catalogs, OAuth discovery, and agent skills indexes.
RFC 9727	API Catalog	RFC discovery	Machine-readable API discovery at /.well-known/api-catalog using Linkset format. How agents find available APIs on a site. Checked by agent-readiness scanners.
RFC 9264	Linkset: Media Types and a Link Relation Type for Link Sets	RFC discovery	The application/linkset+json format used by API Catalog. Structured link sets for machine consumption.
RFC 8288	Web Linking	RFC discovery	Link response headers for agent discovery: service-desc, describedby, api-catalog relations. How agents follow links to capabilities. Checked by agent-readiness scanners.
RFC 9309	Robots Exclusion Protocol	RFC discovery	How agents learn crawl permissions. Foundation for Content Signals and AI bot rules. First thing agent-readiness scanners check.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-farrel-dawn-terminology ↑ -04	Farrel (Old Dog), Yao (China Mobile), Schott (DT), Williams (Infoblox)	discovery	Canonical DAWN terminology: entity, capability card, discoverable object, MDI, trust indicator. Referenced by all other DAWN documents.	Individual, rev -04. clear
draft-akhavain-moussa-dawn-problem-statement ↑ -05	Akhavain, Moussa (Huawei), King (Old Dog)	discovery	Why proprietary directories and manual configuration fail for cross-domain entity discovery. Scopes the DAWN problem space.	Individual, -05. clear
draft-cui-ai-agent-discovery-invocation ↑ -02	Cui, Chao, Du (Tsinghua)	discovery	AIDIP: registry-based agent discovery + RESTful invocation + semantic resolution layer.	Individual, -02, active development. flagged
draft-cui-dns-native-agent-naming-resolution ↑ -02	Cui (Tsinghua)	discovery	DN-ANR: thin DNS resolution layer for agents. FQDNs + SVCB, no semantic metadata in DNS. Clean separation of naming from discovery.	Individual, -02. review
draft-mozleywilliams-dnsop-dnsaid ↑ -02	Mozley, Williams (Infoblox)	discovery	DNS-AID: decentralized DNS-based agent discovery with _agent subdomains and .well-known fallback.	Individual, -02, open source impl. clear
draft-morrison-mcp-dns-discovery ↑ -05	Morrison	discovery	DNS-based MCP server discovery plus a Sovereign-T identity envelope. Lets agents resolve MCP servers without hard-coded URLs.	Individual, rev -05. clear
draft-king-dawn-requirements	King, Farrel (Old Dog)	discovery	Normative requirements for DAWN: what must be discoverable, federation constraints, trust properties any discovery mechanism must satisfy.	Individual, rev -01. clear
draft-mozley-aidiscovery	Mozley, Williams (Infoblox), Sarikaya, Schott (DT)	discovery	AI Agent Discovery problem statement: scope and requirements for agent-to-agent discovery without manual configuration.	Individual, rev -01. review
draft-nemethi-aid-agent-identity-discovery	Nemethi (Open Agent Registry)	discovery	AID v1.2: DNS-first discovery via TXT records at _agent.<domain> resolving agent endpoint URI, protocol token, auth hint, and metadata. SDKs in 6 languages.	Individual, -00. Running code. clear
draft-jimenez-agent-directory	Jimenez (Ericsson)	discovery	Agent Directory adapting CoRE Resource Directory (RFC 9176) to agent registration and lookup. CoAP-friendly counterpart to DNS-based discovery.	Individual, rev -01. clear
draft-seethiraju-dawn-dan	Seethiraju et al. (Verisign)	discovery	DANE-like DNS records (AIDISCA/AIINDEX) for AI agent discovery anchored in DNSSEC. Fits the DAWN cluster.	Individual, -00. Presented at DISPATCH interim. review
draft-serra-mcp-discovery-uri	Serra	discovery	Well-known URI for agents to find MCP servers under a domain.	Individual, rev -04. clear
draft-car-agents-txt-wellknown	Car	discovery	/.well-known/agents.txt + agents.json for site agent permissions. Complements robots.txt and WebBotAuth.	Individual, -00. clear
draft-ietf-aipref-vocab	Thomson et al.	preferences	AI content preferences vocabulary. How sites express preferences about AI crawling/training/output.	WG draft, contentious, MVP push.
draft-pioli-agent-discovery expired	Pioli (Independent)	discovery	ARDP: stable agent identifiers (agent:<id>@<authority>), soft-state registration with JWS proof-of-control, capability advertisement across MCP/A2A/HTTP/gRPC, federated resolution via /.well-known/ardp/.	Individual, rev -01. clear

Agent Protocols and Communication

Aiproto / Agent Communication Protocol (ACP)

Charter: Charter_Merge.md. Targeting IETF 126 BoF. Deliverables: session protocol, authorization token exchange, HITL mechanism, framework. ML: agent2agent

Draft	Authors / Org	Category	Why Relevant	Status
draft-diaconu-agents-authz-info-sharing ↑ -01	Diaconu, Yannuzzi, Muyal, Brockners, Kale (Cisco), Agarwal (Skyfire), Hickman (Ory), Lal (AWS)	security	Extends OAuth Client-ID Metadata with vc+jwt claim carrying W3C Verifiable Credentials for cross-domain agent authorization: dynamic identity, multi-hop delegation with monotonic scope narrowing, SD-JWT/BBS+ selective disclosure.	Individual, -01. clear
draft-scrm-aiproto-usecases ↑ -05	Scrm et al.	protocol	Aiproto WG use cases driving protocol requirements. Reference for the BoF/charter discussion.	Individual, rev -05. clear
draft-jennings-ai-mcp-over-moq	Jennings (Cisco), Swett (Google), Rosenberg (Five9), Nandakumar (Cisco)	protocol	MCP and Agent Skills carried over Media over QUIC Transport. Real-time, multiplexed agent-to-tool communication with MoQ's prioritization and streaming.	Individual, -00. clear
draft-nandakumar-agent-sd-jwt	Nandakumar (Cisco), Jennings (Cisco)	security	SD-Card format: SD-JWT encoding of Agent Cards enabling selective disclosure of capabilities, contact info, and operational metadata with cryptographic integrity and anti-correlation across interaction contexts.	Individual, rev -02. clear
draft-nandakumar-ai-agent-moq-transport	Nandakumar (Cisco), Jennings (Cisco)	protocol	MoQ Transport abstraction layer mapping request-response and streaming patterns onto MOQT pub/sub for both A2A and MCP, enabling interoperability across agent ecosystems over QUIC.	Individual, -00. clear
draft-liu-agent-operation-authorization	Liu, Zhu (Alibaba), Krishnan (Cisco)	security	Two-phase OAuth 2.0 extension using PAR + JWT claims (agent_operation_proposal as OPA/Rego policy, agent_operation_authorization with user-confirmation evidence and delegation_chain) to bind user intent to fine-grained agent actions.	Individual, rev -02. clear
draft-liu-agent-protocol-over-moq	Liu (Alibaba), Krishnan (Cisco)	protocol	Agent-to-agent communication over MoQ with application-layer framing for control signaling, session management, and large data fragmentation. Supports intra- and inter-domain deployment.	Individual, -00. clear
draft-rosenberg-aiproto-cheq expired	Rosenberg (Five9)	protocol	HITL confirmation/quotation exchange for AI agent decisions. Surfaces user-approval steps inside the aiproto framework.	Individual, -00. clear
draft-jennings-mcp-over-moqt expired	Jennings (Cisco)	protocol	MOQT as transport for MCP. Sibling spec to draft-jennings-ai-mcp-over-moq with the updated MOQT mapping.	Individual, -00. review
draft-steele-agent-considerations expired	Steele	protocol	Guidance for IETF specs so AI agents can consume them and generate code. Specs-as-tools framing for the agent era.	Individual, -00. review

HTTP for Agents

Draft	Authors / Org	Category	Why Relevant	Status
draft-mcgraw-httpapi-agent-budget ↑ -03	McGraw et al.	protocol	HTTP fields communicating budget/spend/mutation scope for delegated requesters. Caps cost and scope on a per-request basis.	Individual, rev -03. clear
draft-jurkovikj-httpapi-agentic-state ↑ -02	Jurkovikj	protocol	HTTP concurrency control for agent-managed state across representations. Prevents lost updates between agents acting on the same resource.	Individual, rev -02. clear
draft-gaikwad-agent-friendly-http-api-profile ↑ -01	Gaikwad	protocol	HTTP API profile usable by LLM agents that re-plan per call: stable shapes, machine-readable errors, deterministic pagination.	Individual, -01. clear
draft-campbell-agentic-http expired	Campbell	protocol	Best practices for HTTP usage by AI agents: caching, conditional requests, retries, idempotency.	Individual, -00. clear

AC(p)IP — Agent Communications (private) Internet Protocol

Draft	Authors / Org	Category	Why Relevant	Status
draft-liu-agent-metadata-sync-protocol ↑ -01	Liu (Huawei), Han (China Unicom)	protocol	AMSP: hierarchical Agent Gateways (L1/L2) exchange Agent Records (identity, skills, routing) for global reachability, loop-free metadata propagation across distributed network domains.	Individual, -01. clear
draft-eckert-catalist-acip-framework	Eckert (Futurewei)	protocol	ACIP: network-layer protocol for agent traffic using skill-based addressing, hop-by-hop session-ID forwarding, and AEAD-secured datagrams routable by intermediate nodes. Targets multi-enterprise private-network deployments (fintech).	Individual, -00. CATALIST context. clear
draft-dunbar-agent-attachment	Dunbar (Futurewei), Majumdar (Oracle)	protocol	AAP: control-plane protocol for agents to attach to first-hop edge nodes (ACIP router/gateway), performing authentication, skill registration, and deriving endpoint identifiers for forwarding.	Individual, rev -01. review

AGTP — Agent Transfer Protocol

Draft	Authors / Org	Category	Why Relevant	Status
draft-hood-independent-agtp ↑ -09	Hood (Nomotic)	protocol	AGTP: dedicated application-layer transport for AI agents with intent methods (QUERY, DELEGATE, COLLABORATE), canonical Agent-ID from Birth Certificate hashes, multi-path trust-tier verification, QUIC-preferred transport, and resource budget signaling. Positioned as semantic layer below MCP/A2A/ANP.	Individual, rev -09. Active on agent2agent list. clear
draft-hood-agtp-agent-cert ↑ -03	Hood (Nomotic)	security	Adds cryptographic verification of AGTP Agent-ID/Owner-ID headers at the transport layer.	Individual, rev -03. clear
draft-hood-agtp-discovery ↑ -01	Hood (Nomotic)	discovery	AGTP companion discovery spec: how agents locate AGTP peers and resolve capabilities.	Individual, -01. clear
draft-hood-agtp-session	Hood (Nomotic)	protocol	AGTP session semantics: bounded sessions for transactional flows and persistent sessions for long-lived agent contexts, inheriting identity and authority from base AGTP.	Individual, -00. clear

Cross-Domain Agent Trust

Draft	Authors / Org	Category	Why Relevant	Status
draft-kiliram-agent-trust-auth-framework	King (Lancaster U.), Ramdhany (BBC), Liu (Huawei)	security	Protocol-agnostic trust framework: verifiable agent identity, cross-domain credential issuance, delegation chains, revocation, and auditability for inter-enterprise AI agent ecosystems.	Individual, -00. clear

Other Agent Protocols

Draft	Authors / Org	Category	Why Relevant	Status
draft-birkholz-verifiable-agent-conversations	Birkholz, Heldt, Steele	protocol	Verifiable agent conversation records: CDDL log format signed with COSE_Sign1. Audit trail for agent actions.	Dispatched to VCON WG. review
draft-vandoulas-aidp	Vandoulas	protocol	Agent Interaction Delegation Protocol: control-plane for intent expression, authority delegation, execution binding, and auditable agent loops.	Presented at DISPATCH 125. Needs vendor interest. flagged
draft-yao-catalist-problem-space-analysis	Yao (China Mobile)	protocol	AONP problem space analysis for agent protocol stack.	Individual, CATALIST context. clear
draft-du-catalist-routing-considerations	Du (China Mobile)	protocol	Agentic overlay routing considerations.	Individual, updated March 2026. clear
draft-meunier-web-bot-auth-architecture replaced →	Meunier (Cloudflare), Major (Google)	security	WebBotAuth: HTTP Message Signatures for cryptographic bot/agent authentication.	WEBBOTAUTH WG chartered. Individual draft, rev -05; WG adoption expected at 126. clear

Network Management and AI Agents

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 6241	Network Configuration Protocol (NETCONF)	RFC netmgmt	The MCP-NM draft wraps NETCONF for LLM agents. The protocol agents use to configure network devices.
RFC 8040	RESTCONF Protocol	RFC netmgmt	HTTP-based alternative to NETCONF. MCP-NM and A2A-NM drafts expose RESTCONF via agent protocols.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-cui-nmrg-llm-benchmark ↑ -02	Cui, Du, Xie (Tsinghua)	netmgmt	NetConfBench: GNS3-based benchmark for LLM agents on network config with MCP tools.	NMRG, -02. clear
draft-hong-nmrg-agenticai-ps ↑ -02	Hong et al.	netmgmt	Problem statement for agentic AI in network management: scope, gaps, and where IETF/IRTF can contribute.	NMRG, rev -02. review
draft-feng-nmrg-ain-architecture ↑ -01	Feng	netmgmt	Agentic Intent Network: routed architecture for multi-agent coordination at scale, framework-agnostic.	NMRG, -01. clear
draft-yang-nmrg-mcp-nm	Yang, Wu (Huawei), Lopez (Telefonica), et al.	netmgmt	MCP applicability for network management. MCP server wraps NETCONF/YANG for LLMs.	NMRG, presented at 125. review
draft-yang-nmrg-a2a-nm	Yang, Wu (Huawei), et al.	netmgmt	A2A applicability for network management. Agent-to-agent via Agent Cards.	NMRG, presented at 125. review
draft-wmz-nmrg-agent-ndt-arch	Wu (Huawei), Zhou (China Mobile), et al.	netmgmt	Network Digital Twin + Agentic AI architecture for autonomous network ops.	NMRG, presented at 125. review
draft-jadoon-nmrg-agentic-ai-autonomous-networks	Jadoon, Robitzsch (InterDigital), Bernardos (UC3M)	netmgmt	Agentic augmentation of IP suite: AI Agent Nets alongside each protocol layer.	NMRG, -00. review
draft-bernardos-nmrg-agentic-network-optimization	Bernardos (UC3M), Mourad, Jadoon (InterDigital)	netmgmt	Agentic sensing with network optimization. ISAC use case, 3GPP/ETSI alignment.	NMRG, -00. clear
draft-chuyi-nmrg-agentic-network-inference	Chuyi (China Mobile)	netmgmt	Agentic IP Network: gateways as intelligent agents with multi-level inference.	NMRG, early stage. flagged
draft-irtf-nmrg-llm-nm expired	Cui et al. (Tsinghua)	netmgmt	LLM-collaborative network management framework. Pairs with the NetConfBench benchmark draft.	NMRG-adopted, -00. review
draft-chuyi-nmrg-ai-agent-network expired	Chuyi (China Mobile)	netmgmt	AI-agent-driven network automation framework: agents as first-class actors in the management plane.	NMRG, rev -02. flagged
draft-zw-nmrg-mcp-network-mgmt expired	Zw et al.	netmgmt	Minimal MCP extensions so routers and switches act as MCP servers callable by LLM agents.	NMRG, -00. clear
draft-stephan-ai-agent-6g expired	Stephan et al.	netmgmt	6G AI-agent communication aligning with 3GPP TR 22.870. Bridges IETF agent stack to mobile core requirements.	Individual, rev -02. n/a

Attestation and Trust

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 9052	CBOR Object Signing and Encryption (COSE): Structures and Process	RFC security	Verifiable agent conversations use COSE_Sign1. CoRIM uses COSE. The signing format for constrained and attestation-heavy agent ecosystems.
RFC 8392	CBOR Web Token (CWT)	RFC security	SD-CWT builds on this. Compact credential format for constrained agents and attestation results.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-ietf-rats-corim ↑ -11	RATS WG	security	Concise Reference Integrity Manifest. Foundation for agent environment attestation.	WG draft, rev -11. In WGLC.
draft-tonyai-a2a-trust ↑ -02	Tony et al.	security	A2A trust model: CA-signed templates, spawn chains, dynamic policy across agent-to-agent boundaries.	Individual, -02. clear
draft-ietf-rats-ear	Fossati et al.	security	Entity Attestation Results: standardized format for attestation verifier output. Agent trust decisions consume these.	WG draft, rev -04.
draft-ietf-spice-sd-cwt	Prorock, Steele, Mahy, Birkholz	security	Selective Disclosure CWT: privacy-preserving credentials for constrained agents.	WG draft, rev -08. In WGLC.
draft-lkspa-rats-verifiable-geo-fence	Prasad et al.	security	Verifiable geofencing: bind platform integrity + geographic residency for agent workloads. Moved from WIMSE to RATS namespace.	Individual, rev -03. clear
draft-emirdag-scitt-ai-agent-execution	Emirdag	security	SCITT profile + AgentInteractionRecord for tamper-evident agent action logs. Audit trail using existing SCITT machinery.	Individual, -00. clear
draft-somoza-atn-agent-trust-negotiation replaced →	Somoza	security	Agent Trust Negotiation: post-discovery handshake establishing what an agent will do and under whose authority.	Individual, rev -01. n/a
draft-condrey-rats-pop-protocol expired	Condrey	security	Proof of Process: behavioral signals + hardware attestation to prove human authorship. Explored for agent accountability.	General skepticism at DISPATCH 125. Needs community interest. review

Constrained / IoT Agents

Published Standards (RFCs)

RFC	Title	Category	Why Relevant
RFC 7252	The Constrained Application Protocol (CoAP)	RFC protocol	Foundation for IoT agent communication. CoAP pub-sub and the IoT agent draft build on this.
RFC 8613	Object Security for Constrained RESTful Environments (OSCORE)	RFC security	End-to-end encryption for constrained agents. OSCORE capable proxies draft extends this for multi-hop agent privacy.
RFC 9200	Authentication and Authorization for Constrained Environments (ACE-OAuth)	RFC security	OAuth framework adapted for constrained environments. Bridges OAuth to CoAP for IoT agent authorization.
RFC 6690	Constrained RESTful Environments (CoRE) Link Format	RFC discovery	Resource discovery for constrained agents. How IoT agents discover available resources and capabilities on a network.

Internet-Drafts

Draft	Authors / Org	Category	Why Relevant	Status
draft-jimenez-t2trg-iot-agent ↑ -01	Jimenez (Ericsson)	protocol	Agentic AI operation of IoT systems. HATEOAS-like agent discovery over CoAP.	Individual, -01. clear
draft-ietf-core-coap-pubsub ↑ -21	Jimenez et al.	protocol	CoAP Pub-Sub: event-driven communication for constrained agents.	WG draft, rev -21. Awaiting chair go-ahead.
draft-ietf-core-oscore-capable-proxies ↑ -07	Tiloca et al.	security	OSCORE nesting for multi-hop agent privacy. End-to-end encryption through proxy chains.	WG draft, rev -07.