Individual Submission S. P. Ahuja Internet-Draft Main Labs Intended status: Informational 20 October 2026 Expires: 23 April 2027 A Policy Grammar for Inter-Domain Agent Routing draft-ahuja-agent-routing-policy-03 Abstract Agent tasks are delegated across organizational boundaries. Existing work specifies how agents are identified, discovered, and described, states requirements for cross-domain isolation and authorization, and identifies the absence of a mechanism for expressing capability policy as a gap. This document defines four policy attributes for inter-domain agent delegation, the declarations each attribute carries, and a validity condition on delegation chains that no party establishes by observing the whole chain. Whether independently chosen policies converge is analysed in separate work. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 23 April 2027. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components Ahuja Expires 23 April 2027 [Page 1] Internet-Draft Agent Routing Policy October 2026 extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3 3. Relationship to Existing Work . . . . . . . . . . . . . . . . 4 4. Scope Comparison Vocabulary . . . . . . . . . . . . . . . . . 5 5. Policy Attributes . . . . . . . . . . . . . . . . . . . . . . 6 5.1. Graduated Self-Deprioritization . . . . . . . . . . . . . 6 5.2. Non-Binding Preference Signalling . . . . . . . . . . . . 7 5.3. Opaque Policy Tags . . . . . . . . . . . . . . . . . . . 7 5.4. Chain Validity Attribute . . . . . . . . . . . . . . . . 8 6. Profile Identity . . . . . . . . . . . . . . . . . . . . . . 8 7. Attribute Declaration . . . . . . . . . . . . . . . . . . . . 9 8. Transitivity Conformance . . . . . . . . . . . . . . . . . . 9 9. Chain Validity Condition . . . . . . . . . . . . . . . . . . 11 10. Requirements and Gaps Addressed . . . . . . . . . . . . . . . 13 11. Security Considerations . . . . . . . . . . . . . . . . . . . 14 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 13. References . . . . . . . . . . . . . . . . . . . . . . . . . 15 13.1. Normative References . . . . . . . . . . . . . . . . . . 15 13.2. Informative References . . . . . . . . . . . . . . . . . 15 Changes Since -02 . . . . . . . . . . . . . . . . . . . . . . . . 17 Changes Since -01 . . . . . . . . . . . . . . . . . . . . . . . . 18 Changes Since -00 . . . . . . . . . . . . . . . . . . . . . . . . 18 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 19 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 19 1. Introduction A delegation crosses an organizational boundary when the party receiving a task is operated by someone other than the party sending it. The sender then has no view of what happens to the task after it is delegated, and the receiver is acting under policy the sender cannot inspect. [INTENTREQ] requires that a coordination substrate let an organization isolate its capability namespace, and that interoperation across organizational boundaries be explicitly authorized and policy-controlled (REQ-13). [GWGAP] Section 7.2 states the same absence as a gap: capability descriptions say what an agent can do and do not say who may discover or invoke it under what conditions, and there is no standard mechanism for expressing, distributing, and enforcing those constraints. This document specifies a mechanism for the expression half of that gap. Ahuja Expires 23 April 2027 [Page 2] Internet-Draft Agent Routing Policy October 2026 The test applied throughout is whether a behaviour must be specified to survive crossing a boundary, or whether a domain may decide it alone. An attribute a domain can implement internally, with no counterparty obliged to read it, does not belong in a protocol. Each attribute in Section 5 is here because it fails that way. The attributes are declarations that domains exchange. They are not the decision logic a domain applies to them. How a domain weighs a counterparty's declarations, and what it chooses as a result, remains its own and is not specified here. Nor are the attributes a control plane that propagates routes between domains. Domains exist for administrative reasons. Data residency law, sovereign compute programmes, sunk regional infrastructure, and organizations that will not route work through a competitor's systems all produce boundaries that no improvement in agent capability removes. This document takes no position on whether specialised or general agents prevail. 2. Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. Domain: A jurisdiction of policy ownership. A domain owns policy over the agents it operates and over the delegations it accepts and emits. The term carries no claim about knowledge, capability, or subject-matter expertise. Two domains may operate identical agents and hold opposite policies. Delegation: The transfer of a task from one agent to another. Delegation chain: The ordered sequence of delegations by which a task reaches its current holder. A chain of length zero is a task that has not been delegated. Hop: A single delegation, together with the domains on either side of it. Governing profile: The immutable definition, agreed between the parties to a hop, under which attribute values are compared. Profile identity is subject to Section 6. A profile is not global; two hops in one chain may name different profiles, with the consequence stated in Section 9. Ahuja Expires 23 April 2027 [Page 3] Internet-Draft Agent Routing Policy October 2026 Attenuation relation: The relation a profile defines between two values of an attribute, under which one value is no broader than another. Relying party: A party evaluating a hop or a chain in order to accept, delegate, or refuse a task. 3. Relationship to Existing Work Agent identity, discovery, and capability advertisement are specified elsewhere and are not restated here. This document assumes an agent can be named, located, and described. [INTENTREQ] and [GWGAP] are the documents this mechanism answers. Section 10 states which requirements and gaps each part of the grammar addresses and which constrain it. [BCR] supplies the scope-comparison vocabulary and the chain- composition rules this document uses. They are adopted, not extended; see Section 4. [BINDING] states the same non-elevation property for composed verifier results generally, and is cited where this document relies on it. Authorization frameworks answer whether a party may act. An authorization decision does not identify who holds a task after the permitting credential expired, and it does not identify who is accountable for a task two delegations further along the chain from the party that was authorized. Policy over delegation is not a generalised form of authorization and does not subsume it. [AGENTICREQ] Section 4 states that crossing an administrative boundary adds authentication and authorization requirements, which it assigns to the OAuth and WIMSE work, and privacy requirements on dialog context. None of those is the policy a domain expresses over what happens to a task after it leaves the domain. That policy is not an authorization decision, for the reason in the preceding paragraph, and it is the subject of this document. [AINDEPLOY] reaches the same conclusion from deployment: it describes the inter- domain phase as requiring new protocol design currently under research (Section 4.3), and lists "inter-domain policy and governance" as the complexity that phase adds (Table 3). [ROSENBERG] Section 3.3.2 treats routing between agents as the invoking agent's decision, made on information the invoked agent supplies about itself, such as language and channel capability. This document adds the policy a domain expresses about that decision when the agents sit in different domains. Ahuja Expires 23 April 2027 [Page 4] Internet-Draft Agent Routing Policy October 2026 Whether a claimed transition can later be established by a party that did not participate in it is treated in [DET], and the evidentiary weight of records asserting order is treated in [DECREC]. This document produces no evidence artifacts and makes no ordering or retrospective-determinability claims. 4. Scope Comparison Vocabulary This document does not define a comparison vocabulary. It uses the one published in [BCR] Section 7, and implementers are expected to read that section. A relying party MAY use a scope verifier conforming to [BCR] to evaluate the attribute defined in Section 5.4. The summary below identifies only what this document relies on. Membership and attenuation are separate decisions. Membership returns IN_SCOPE, OUT_OF_SCOPE, or UNDECIDED. Attenuation returns NO_BROADER, BROADER, or UNDECIDED. This document is concerned with attenuation. Where an attribute has mandatory components, the composite rules of [BCR] Section 7 apply unchanged: any BROADER component makes the composite broader, otherwise any UNDECIDED component makes the composite UNDECIDED, each component result remains visible, and a missing component is not a successful comparison. An UNDECIDED attenuation result states why. Two reasons defined in [BCR] are relied on here, and they are relied on because a relying party does different things with them. NO_COMPARISON_RELATION: The verifier holds the exact governing profile and that profile supplies no applicable relation for the component and values reported. This is absence of a relation under that profile and is not a claim that comparison is globally impossible. No party holding different inputs changes it, so the relying party halts. PROFILE_NOT_HELD: The exact governing profile definition is unavailable to the deciding verifier. Its absence does not establish that the profile defines no relation. Retrieval of the exact definition, or re-evaluation by a verifier accepted under relying-party policy, may remedy it, so the relying party MAY route the evaluation. These two do not exhaust the causes of UNDECIDED, and another cause MUST NOT be reported as either of them. Until a required current comparison succeeds, the relying party refuses. Evaluation, and any refusal it produces, happens at the point a delegation is offered for acceptance. Ahuja Expires 23 April 2027 [Page 5] Internet-Draft Agent Routing Policy October 2026 LOCAL_ONLY is a composition status carried on a decided attenuation result, separate from that result. It is not a fourth attenuation value and not a substitute for UNDECIDED. A negative local result stays negative whatever its composition status. UNDECIDED describes an unavailable comparison. It is not the execution outcome INDETERMINATE, and the two MUST NOT be reported interchangeably. [AGENTICREQ] B1-8 and CMN-12 require a participant to be able to determine whether a check failed or could not be completed. For a comparison under this document, BROADER is the first and UNDECIDED is the second. The distinction is that of [BCR] Section 7, which this document adopts. [KONDA] generalizes the distinction between the two reasons defined in [BCR] to evaluation state at any decision point, and its Section 4.2 states what a report carrying either reason needs to carry when it reaches a participant in another domain. This document applies the two reasons at a delegation hop. 5. Policy Attributes Each attribute is stated in the same form: what the advertising domain asserts, what a receiving domain is obliged to do, what it is not obliged to do, and what the attribute does not establish. An attribute value carried on a delegation MUST be accompanied by the declarations in Section 7. Attribute values are compared by matching declared identifiers under the governing profile. Evaluating an attribute MUST NOT require any party to interpret the semantics of the task, consistent with REQ-10 and REQ-11 of [INTENTREQ]. 5.1. Graduated Self-Deprioritization A domain advertises a graduated reduction in its willingness to receive delegations, without becoming unreachable. The advertising domain asserts that delegations to the named agents remain acceptable and that it prefers they be sent elsewhere where an alternative exists. A receiving domain MUST treat the advertisement as ordered against other advertisements from the same domain under the governing profile. It MUST NOT treat the advertisement as a refusal, and MUST NOT require the advertising domain to justify the value. Ahuja Expires 23 April 2027 [Page 6] Internet-Draft Agent Routing Policy October 2026 This attribute does not establish capacity, health, or load. A domain may deprioritize itself for contractual reasons unrelated to its state. A relying party that reads load from this attribute is reading something the attribute does not carry. 5.2. Non-Binding Preference Signalling A domain advertises a preference among its own endpoints to a counterparty that will make the selection. The advertising domain asserts a ranking over agents it operates. The counterparty MAY use the ranking and MAY disregard it. A domain MUST NOT treat its own preference as having bound the counterparty's choice, and MUST NOT refuse a delegation solely because the counterparty selected a lower-ranked endpoint. REQ-7 of [INTENTREQ] requires that any selection depending on real- time state be made by the entity holding that state. This attribute