Agentic AI Use Cases and Requirements

REQ-ID	Description	Tag
CMN-1	The protocol is required to support any client application to communicate with any agent service.	Authentication
CMN-2	Mutual authentication is required between all communicating parties.	Authentication
CMN-3	All protocol traffic is required to be encrypted and integrity-protected in transit.	Security
CMN-4	Structured error responses are required to include an authorization scope violation type, reported by the orchestrator or mediator when an agent attempts an action that exceeds or contradicts the scope delegated to it.	Security
CMN-5	Structured error responses are required, distinguishing at minimum: authentication failure, authorization failure, timeout, and internal error.	Transport
CMN-6	The protocol is required to provide a means to signal task priority so that critical-path tasks can be scheduled ahead of lower-priority ones.	Transport
CMN-7	The protocol is required to support cryptographic algorithm agility, ensuring that cryptographic algorithms used for encryption, authentication, credential verification, and integrity protection can be negotiated and updated over time, in accordance with .	Security, Authentication
CMN-8	The protocol is required to provide a means to verify the agent authentication credentials validity used by agents at the time of use.	Authentication
CMN-9	The protocol is required to support signaling that a presented credential has been revoked or is otherwise invalid.	Security
CMN-10	The protocol is required to support revoking a previously granted authorization, including propagating the revocation across a delegation chain so that affected agents cease to act under it.	Security
CMN-11	The protocol is required to support establishment, modification, and termination of a dialog, distinct from cancellation of a delegated subtask within the dialog. Modification includes changes to the participants, modalities, or lifetime of the dialog. The protocol is required to support a dialog lifetime, after which the dialog is terminated.	Dialog
CMN-12	Before accepting a change to a dialog, a participant is required to be able to verify that the change is authorized at that time. If this check fails or cannot be completed, the participant is required to reject the change and signal the reason. It is required to be able to determine which of the two cases occurred.	Dialog, Security

Use Cases These interactions differ from ordinary application-to-service invocation in several respects, one being runtime selection of agents and tools by capability. An agent's internal processing, including perception, planning and re-planning, and invocation of its AI model, is not visible on the protocol interface and is out of scope; it motivates the use cases but drives no protocol requirement. Cross-domain operation can apply to any of these use cases. Crossing an administrative boundary adds authentication and authorization requirements, which map to the OAuth and WIMSE work discussed in , and privacy requirements on dialog context propagated across the boundary, discussed in . The use cases are independent of deployment model: they apply whether participants are within a single administrative domain or span several, and whether they interact directly or through intermediaries.

Simple Single-Agent Task

Description A user submits a task to an AI agent via a client application. The agent executes the task by invoking one or more tools and returns results to the user. The tools invoked by the agent may reside in the same or a different administrative domain. The agent protocol is required to support multiple input and output modalities, and the client application and agent are required to be able to negotiate which modalities are active for the dialog. This use case covers the protocol interface between the client application and the agent. The interaction between the user and the client application is out of scope. This use case assumes that the user communicates with the agent via a client application; direct communication between a user and an agent without an intermediary client application is not covered in this use case. This interaction pattern is described in .

Example A user books a flight through a travel booking app. The app is the client application. It sends the user's request to a travel agent run by the travel company that provides the app. The agent uses two tools: a fare search tool run by the travel company, and a booking tool run by an airline, in a different administrative domain. | Travel agent |----->| Fare search | | | | | | (travel co.) | +------------+ +--------------+ +----------------+ | | +----------------+ +------------->| Flight booking | | (airline) | +----------------+ ]]>

The app establishes a dialog with the agent and asks for a flight on a given route and date (CMN-11).
The agent queries the fare search tool and streams matching flights to the app within the dialog (A1-1).
The user picks a flight. The agent calls the airline's booking tool with a credential showing that the user authorized the booking, without the user's airline credentials (A1-9).
The agent returns the booking confirmation, and the app terminates the dialog (CMN-11).

If the user abandons a search before step 3, the app cancels that task (A1-2). The dialog continues, and the user can start a new search in it without starting over.

Protocol Requirements This use case involves two distinct protocol interfaces. The App/Agent-to-Agent interface is between the party making the request, which may be a client application or another agent, and the agent that handles it. The Agent-to-Tool interface is between the agent and the tools it invokes. A given requirement does not necessarily apply to both; the Interaction column indicates which interface each applies to.

REQ-ID	Description	Interaction	Tag
A1-1	The protocol is required to support incremental streaming of agent output, allowing partial results to be delivered to the client before the agent has completed processing.	App/Agent-to-Agent	Transport
A1-2	The protocol is required to define a task cancellation message that the client can issue at any point during task execution.	App/Agent-to-Agent	Transport
A1-3	The protocol is required to define structured error message types that distinguish at minimum: transport failure, tool invocation failure, and agent processing failure.	Both	Transport
A1-4	The protocol is required to support multiple modalities for both input and output.	App/Agent-to-Agent	Transport
A1-5	The protocol is required to support modality negotiation at dialog establishment, allowing the client and agent to agree on which modalities are active for the dialog.	App/Agent-to-Agent	Dialog, Transport
A1-6	The protocol is required to support agent-initiated notifications to the client during task execution.	App/Agent-to-Agent	Transport
A1-7	The protocol is required to support concurrent invocation of multiple tools within a single agent task, where tools may be operated by distinct providers across different administrative domains, each with independent authentication and authorization requirements.	Agent-to-Tool	Transport, Security
A1-8	The protocol is required to support bulk transfer of large data between communicating parties, applicable to both agent-to-tool and agent-to-agent interactions.	Both	Transport
A1-9	A delegation mechanism is required to be defined by which an agent presents to a tool provider a credential attesting the authorization for the requested tool access, without exposing the client's primary credentials.	Agent-to-Tool	Authentication
A1-10	The protocol is required to preserve the dialog context when a participant transforms data from one modality to another, such as audio to text.	App/Agent-to-Agent	Dialog

Orchestrator and Agent Collaboration

Description An orchestrator agent acts as a controller, decomposing a task into subtasks and delegating them asynchronously to one or more other agents. The orchestrator decides which other agents to invoke, sequences the delegation, and aggregates results to continue task execution. Each agent executes the respective subtask independently and reports results back to the orchestrator. It should be noted that AI models are stateless by nature: each inference call processes only what is explicitly provided with a particular context, with no persistent memory between calls. The application layer is responsible for maintaining the context across the calls by carrying conversation history, intermediate results, and task state. Dialog continuity is therefore required to preserve the dialog context across network interruptions, so that a reconnecting agent can re-associate with the dialog and use it to restore its own task context without reconstructing it from scratch. If a dialog is interrupted before the result of an operation reaches the delegating agent, the operation may or may not have completed. Resuming the dialog does not tell the delegating agent which. Before resending the operation, the delegating agent checks its outcome with the delegated agent or tool that performed it. If the outcome cannot be determined, the operation remains unresolved, and resuming the dialog alone does not justify resending it. This pattern is reflected in , and is implemented in deployed multi-agent frameworks including , , and .

Interaction Flow | Agent-1 | | |<--Result Reporting-----| | | | +------------+ | | | | +------------+ | |---Task Delegation----->| Agent-2 | | |<--Result Reporting-----| | +---------------------+ +------------+ ]]>

Example A user asks a trip planning agent, the orchestrator, to arrange a business trip. The orchestrator delegates the flight booking to a flight agent and the hotel booking to a hotel agent. Both agents are run by different providers. | Flight agent | | Trip planner | +--------------+ | (orchestr.) | | | +--------------+ | |----->| Hotel agent | +--------------+ +--------------+ ]]>

The orchestrator establishes a dialog with each agent and delegates both subtasks without waiting for either to finish (B1-1, B1-2).
The flight agent streams fare options and reports the booked flight (B1-4, B1-3).
The connection to the hotel agent drops after the orchestrator asks it to book a room, before the confirmation arrives.
The orchestrator reconnects and resumes the dialog with the hotel agent (B1-6). The hotel agent verifies that the orchestrator is the participant whose exchange was interrupted, and that the dialog is current and still authorized (B1-7).
Before booking again, the orchestrator asks the hotel agent whether the booking completed. If it did, the orchestrator uses that booking. If the outcome is not yet known, the booking stays unresolved: the orchestrator does not book again, and asks again. After a set time or number of attempts, it informs the user.

Protocol Requirements

REQ-ID	Description	Tag
B1-1	The protocol is required to facilitate task delegation for an orchestrator to agents that includes task delegation and acknowledgement message types.	Transport
B1-2	The protocol is required to support asynchronous delegation, allowing the orchestrator to delegate to multiple agents without waiting for each to complete before proceeding.	Transport
B1-3	The protocol is required to define a result reporting message by which an agent returns its completed output to the orchestrator.	Transport
B1-4	The protocol is required to support streaming of intermediate results from the agent to the orchestrator during task execution.	Transport
B1-5	The protocol is required to define a task cancellation message that the orchestrator can send to an agent to abort a delegated subtask.	Transport
B1-6	The protocol is required to support persistent dialog identifiers that survive network interruption or change, and is required to define a dialog resumption message by which an agent re-attaches to an interrupted dialog, restoring the prior dialog context.	Dialog
B1-7	On resumption, the protocol is required to enable the receiving participant to verify that (1) the party resuming the dialog is the participant whose exchange was interrupted, (2) the dialog context presented is the current state of that dialog, and (3) the dialog has not been terminated and its authorization has not been revoked.	Dialog, Security
B1-8	If any check in B1-7 fails or cannot be completed, the dialog is not resumed and the protocol is required to signal the reason. The receiving participant is required to be able to determine whether the check failed or could not be completed.	Dialog, Security

Long-Running Delegated Task with Authorization Checkpoint

Description An orchestrator agent delegates a long-running task to other agents. The delegated agent executes the task autonomously and sends progress notifications to the orchestrator. At any certain point one or more delegated agents pause and request explicit authorization from the orchestrator before proceeding further. The orchestrator may relay this authorization request to the invoker (user or agent) or resolve it autonomously based on policy. This pattern is reflected in the In-Task Authorization mechanism defined in .

Interaction Flow | | | |<--Progress Notif.------| | | |<--Authz Checkpoint-----| Agent(s) | | |---Authz Response------>| | | |<--Result Reporting-----| | +---------------------+ +------------+ ]]>

Example A user asks a banking assistant, the orchestrator, to close an account. The orchestrator delegates the closure to an account closure agent, which runs a workflow that can take several days. | Banking |<---->| Account | | | | assistant | | closure agent | +------------+ +--------------+ +---------------+ ]]>

The orchestrator establishes a dialog with the closure agent and delegates the closure. The dialog lasts for the whole workflow.
The closure agent cancels the account's standing payments and closes the linked debit card. After each step it sends the orchestrator a progress notification, such as "standing payments cancelled" (B2-1).
Before transferring the remaining balance, the closure agent pauses and sends an authorization checkpoint request stating the amount and the destination account (B2-2, B2-6).
The orchestrator relays the request to the user, who approves it with a different destination account (B2-3). The approval covers only this transfer (B2-5).
The closure agent completes the transfer and reports the result. If no response had arrived before the timeout, it would have halted the transfer and treated the request as unresolved (B2-4).

Additional Protocol Requirements This use case builds on the requirements defined for and introduces additional requirements specific to authorization checkpoints in delegated tasks.

REQ-ID	Description	Tag
B2-1	The protocol is required to support agent-initiated progress notifications to the delegating agent during task execution.	Transport
B2-2	The protocol is required to define an authorization checkpoint request, by which an agent pauses task execution and asks the orchestrator to authorize a specific action before proceeding. The request is required to describe the action to be performed and the effect it would have, so the orchestrator has enough information to decide.	Transport, Security
B2-3	The protocol is required to define the responses to an authorization checkpoint request, which include at minimum approve, deny, and approve with modified parameters. A denial is required to be conveyed as an explicit error response.	Transport, Security
B2-4	The protocol is required to support a response timeout, after which the agent treats the request as unresolved and halts the affected subtask.	Transport
B2-5	An authorization checkpoint response is required to authorize only the action in the request it answers, including any approved modification to that action, and not any different or later action.	Transport, Security
B2-6	The protocol is required to support authorization requested and granted at the granularity of a specific operation, so that a sensitive action is authorized individually rather than covered by a broad, pre-existing authorization.	Transport, Security

Peer Collaborative Multi-Agent Problem Solving

Description A task requires coordinated problem solving across multiple agents, where no single agent has full authority or capability to complete the task alone. The agent that receives the initial request dynamically delegates subtasks to peer agents based on their advertised capabilities. Any agent may itself delegate further to other agents and use other tools, forming a dynamic collaboration graph. Each agent remains opaque to others, collaborating only through the protocol interface. This use case introduces multi-hop delegation chains that are not present in . Each agent in the chain may delegate further to other agents, and authorization scope is required to be progressively constrained at each hop. This use case is described in .

Interaction Flow

The hiring agent establishes a dialog with the sourcing agent and delegates the search, with an authorization limited to this job listing (B3-1).
The sourcing agent delegates the search to the job board agent. It carries the same dialog, or creates a new dialog linked to it (B3-9). It passes an authorization narrowed to a read-only candidate search (B3-1, B3-8). The job board agent can determine that the hiring manager originally authorized the task (B3-2).
If the job board agent becomes unavailable, the sourcing agent detects this and halts that subtask (B3-5).
The hiring manager picks candidates, and the hiring agent delegates interview scheduling to the scheduling agent, in the same dialog or in a new dialog linked to it.

Additional Protocol Requirements This use case builds on the requirements defined for and introduces additional requirements specific to multi-hop delegation chains.

REQ-ID	Description	Tag
B3-1	The protocol is required to support multi-hop delegation chains, where an agent that receives a delegated subtask may itself delegate further to other agents. At each hop, the delegating agent is required to present a credential that does not exceed the authorization scope of the credential it received.	Authentication, Security
B3-2	The protocol is required to preserve the identity of the originating entity across all hops in the delegation chain, such that any agent in the chain can determine the identity of the entity that originally authorized the task.	Authentication, Security
B3-3	The protocol is required to support transferable credentials that carry the original authorization constraints across all hops in the delegation chain. Each receiving agent is required to be able to cryptographically verify that the credential presented to it was issued by the delegating agent and that the chain of delegation traces back to the original authorization.	Authentication, Security
B3-4	The protocol is required to ensure that authorization granted to an agent in a delegation chain, including for tool invocations, is derived from the authorization issued by the initiating agent, and not from the identity or authorization scope of any intermediate agent in the chain.	Authentication, Security
B3-5	The protocol is required to allow a delegating agent to detect that a delegated agent has become unavailable and to halt the affected in-flight subtask.	Dialog, Transport
B3-6	The protocol is required to provide a verifiable provenance record of a request and its response as they traverse the delegation chain, attributing each transformation to the hop that performed it, such that removal of a hop, or a modification not attributable to a signing hop, is detectable.	Authentication, Security
B3-7	The protocol is required to enable a receiving party to detect and reject a delegation chain that contains a cycle, such as a chain in which the receiving party's own identifier already appears.	Authentication, Security
B3-8	The protocol is required to enable a receiving party to determine that the authority conveyed to it does not exceed the authority conveyed to the hop it received from.	Authentication, Security
B3-9	The protocol is required to propagate the dialog context across each hop of a delegation chain, so that participants can correlate interactions along the chain. A participant may instead create a new dialog, with a new dialog context, linked to the one it received.	Dialog

Cooperative Reasoning and Consensus Formation

Description A set of peer agents is tasked with analyzing a shared problem independently and exchanging intermediate reasoning outputs to converge on a collective conclusion. A coordinator agent distributes the problem to all participating agents, collects their reasoning outputs, and drives the convergence process across multiple rounds until a consensus conclusion is reached. Unlike , all agents work on the same problem rather than different subtasks. Two communication topologies are possible. In the first, agents communicate only through the coordinator, which acts as the central hub for all message exchange. In the second, agents may also communicate directly with each other to exchange intermediate reasoning outputs without routing through the coordinator agent. The second topology introduces the same multi-hop authorization requirements defined in .

Interaction Flow The coordinator-mediated topology: The direct agent-to-agent topology: |Agent-2| <-> |Agent-3| +-------+ +-------+ +-------+ ^ ^ |___________________________| ]]>

Example A network operator's coordinator agent diagnoses a service outage. It distributes the alarms to three diagnosis agents, for the radio, transport, and core networks, each supplied by a different vendor.

The coordinator establishes a dialog with the three agents and distributes the alarms to all of them (B4-1).
Each agent analyzes the alarms independently and returns a likely root cause. The transport agent points to a failed link; the other two report symptoms only.
The coordinator shares the results in a second round. The radio and core agents check them against their own data and agree.
The coordinator adds a power systems agent to the dialog to rule out a site power fault (CMN-11, B4-1), then reports the consensus: a failed transport link.

Additional Protocol Requirements This use case builds on the requirements defined for and introduces additional requirements specific to group message delivery.

REQ-ID	Description	Tag
B4-1	The protocol is required to support one-to-one, one-to-many, and many-to-many message delivery among a defined group of agents. Group membership is required to be dynamic, allowing agents to join or leave the group during the course of an exchange.	Transport, Security

Tool, Data, and API Mediation Between Agents

Description In many multi-agent deployments, access to external resources such as APIs, databases, enterprise systems, or hardware interfaces is intentionally mediated through a designated mediator. Other agents request the mediator to perform actions or retrieve data on their behalf, rather than directly invoking external systems. This architecture allows access control, auditing, rate limiting, and schema normalization to be applied uniformly at the mediation layer. The mediator may also serve as an adapter between the agent protocol and non-agent systems or other services that do not natively support agent communication protocols, or between different agent communication protocols such as translating between the agentic protocol suite being developed at the IETF and existing protocols such as and . In this role, the mediator is responsible for protocol translation and for presenting the appropriate credentials to the target system on behalf of the requesting agent. The mediator may additionally act as a request router, dispatching requests to appropriate agents or tools based on the content and context of the request, without requiring the requesting agent to have prior knowledge of which agent or tool is most appropriate. The mediator may also validate agent requests before invocation, checking whether the action being requested matches the authorization granted to the agent and whether execution would cause unintended or irreversible side effects. Note that mediating can be a function within an orchestrator. The mediator can be deployed as a proxy between an agent and its tools, such as an MCP proxy. The 3GPP 6G architecture study describes it as an agent gateway through which third-party agents use network services. This pattern is reflected in the MCP server architecture defined in and the agent routing patterns discussed in .

Interaction Flow

Example A mobile network operator runs an agent gateway through which authorized third-party agents use network services, which act as tools. A concert organizer's agent asks for extra network capacity at the venue during the concert. | Agent |----->| Network service | | agent | | gateway | | (tool) | +-------------+ +----------+ +--------------------+ ]]>

The organizer's agent establishes a dialog with the gateway and requests extra capacity at the venue for the hours of the concert.
The gateway checks that the request matches the organizer's authorization, translates it into the network service's interface, and invokes it on the agent's behalf.
The gateway confirms the added capacity to the organizer's agent.
After the concert, the organizer's agent terminates the dialog (CMN-11).

Additional Protocol Requirements

REQ-ID	Description	Tag
B5-1	The protocol is required to define error response types for request validation failure (rejected due to potential unintended or irreversible side effects) and protocol translation failure (rejected on unsuccessful translation of a request or response between supported protocols), distinct from authorization failure.	Transport, Security
B5-2	The protocol is required to support continuation of a dialog through a different mediator when the mediator in use fails.	Dialog
B5-3	The protocol is required to enable a mediator that translates between agent communication protocols to carry the dialog context across the translation, so that participants on each side can correlate the dialog.	Dialog