| Internet-Draft | AI/ML Agents requirements | October 2026 |
| Sarikaya & Schott | Expires 14 April 2027 | [Page] |
This document presents system and Radio Access Network (RAN) requirements for 3GPP Artificial Intelligence/ Machine Learning (AI/ML) and AI Agents for the 6th generation mobile network, or 6G. Requirements depend on the types and application areas of agents. We describe some of them defined with each type and state their requirements. RAN 6G requirements are discussed including AI related requirements. AI Agent implementation efforts, initiatives on how APIs can be discovered, how inter-domain and intra domain AI Agents can be discovered using DNS lookup and agent protocol design are explained.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 14 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Artificial Intelligence (AI) has historically been defined as the science and engineering to build intelligent machines capable of carrying out tasks as humans do. Inspired from the way human brain works, machine learning (ML) is defined as the field of study that gives computers the ability to learn without being explicitly programmed. Since it is believed that the main computational elements in a human brain are 86 billion neurons, the more popular ML approaches are using “neural network” as the model. Neural networks (NN) take their inspiration from the notion that a neuron’s computation involves a weighted sum of the input values. A computational neural network contains the neurons in the input layer which receive some values and propagate them to the neurons in the middle layer of the network, which is also called a “hidden layer”. The weighted sums from one or more hidden layers are ultimately propagated to the output layer, which presents the final outputs of the network.¶
Recurrent neural network (RNN) models are a type of deep neural networks which use sequential data feeding. The input of RNN consists of the current input and the previous samples. RNN models recently have been replaced with parallel processing [LLMPaper] and the transformer architecture and they are being used in the natural language processing task on mobile devices, e.g., language modeling, machine translation, question answering, word embedding, and document classification. The resulting system is commonly called Large Language Model (LLM).¶
AI Agents play a crucial role in modern telecommunications by enabling intelligent automation, decision-making, and adaptive network management. These agents are software-driven entities that leverage artificial intelligence, including machine learning and natural language processing, to interact with users, applications, and network components. In a 6G environment, AI agents enhance network efficiency by dynamically optimizing resources, predicting network conditions, and facilitating providing seamless communication between services.¶
By integrating Large Language Models (LLM), AI agents can understand complex requests, translate them into actionable insights, and orchestrate 3GPP services like communication service, sensing service, network capabilities and functions autonomously. This ultimately improves user experience when consuming the 3GPP services, operational efficiency, and service innovation.¶
This document aims to present the types of AI agents 6G network needs and the requirements needed to support each case, i.e. Stage 1 work of 6G in Section 2. Radio Access Network requirements in general as well as AI related are also covered Section 3. We discuss implementation issues, i.e. recent IETF initiatives on AI agents in Section 4.¶
In a related work, [ai-agent-6g] attempts to analyze the agent protocol requirements and relevant enabling technologies based on 6G mobile communication system specific characteristics. Using examples of use cases and service requirements contained in [TR22.870] the draft extrapolates possible requirements related to agent communication protocols. It emphasizes the need for interoperable protocols, multimodal, aka, multi media data support, and dynamic agent discovery mechanisms to fulfill AI agent coordination.¶
On the other hand [aiagentusecase] introduces use cases and requirements on AI Agents in 6G networks. It attempts to elaborate on the requirements for high performance communication, security and energy efficiency.¶
[TR22.870] states a total of 61 use cases covering from connected cars to AI Agent collaboration, AI Agent assisted rescue in water parks. In this document we discuss a few of the use cases below and related system requirements.¶
A third-party application (e.g. a smart city traffic management system) AI Agent sends a text-based request or query to the 6G network. The request is processed by an AI agent in the 6G network that leverages LLMs and the network's advanced capabilities (e.g. sensing, real-time data processing, telemetry, analytics, and others) to provide a response or perform an action. This interaction is like how users interact with AI models (query and response), but it is tailored for network-specific tasks and applications.¶
Requirements¶
The network shall be able to support secure means to expose its services to the authorised third-party AI agent based on its intent.¶
The network shall be able to support AI capabilities like AI Agents to provide many 3GPP services in response to received intents from a third-party AI Agent. Note that an intent is a high-level declarative statement of desired operational goals and outcomes for a network. It describes what is needed not how to implement.¶
Autonomous agents (AI agents) have long been recognized as a promising approach to achieving artificial general intelligence (AGI), which is expected to accomplish tasks through self-directed planning and actions. In recent years, these agents, leveraging the capabilities of LLMs, are expected to effectively perform diverse tasks in social science, natural science, and engineering, among others. AI agents can take on various forms, such as embodied intelligent robots, virtual assistants, and autonomous systems (e.g. drones).¶
Requirements¶
The network shall support trusted network access for 3rd party AI agent and support a mechanism to expose 3rd party AI agent’s attributes (e.g. related users, sensing capabilities, AI capabilities, service features) to other 3rd party AI agents.¶
The network shall be able to support security identification for 3rd party AI agents provided by authorized 3rd party associated with a user (e.g. AI agents belonging to a customer).¶
The network shall support mechanisms for 3rd party AI agents to provide/register their attributes (e.g. sensing capabilities, AI capabilities, service features, associated authorized users) to 6G network, and discover other authorized 3rd party AI agents to achieve collaborative task.¶
The network shall provide means to support efficient and secure communication between 3rd party AI agents over a wide area in a group considering the diverse lifetime of tasks.¶
AI agent on device will be popular in 6G era, due to the fast development on device-based computing power and LLM model light-weighting.¶
Requirements¶
The system shall provide a suitable means for an AI agent application on UE to invoke some 3GPP services (e.g. IMS service).¶
The system shall provide an efficient way to expose information (e.g. change of QoS) to the application on the UE.¶
The network shall be able to support the message exchange between the AI agent application on different UEs considering the diverse capabilities supported by different AI applications (e.g. AI agents applications).¶
AI Agents can perform tasks for or represent e.g. devices, persons, drones, or cars. These AI Agents may be either implemented in a UE or in the network. By offloading tasks to the network, devices can save on complexity and energy consumption. Furthermore, an AI Agent in the network can still represent a device, person, drone or car, when that device, person, drone or car is not reachable, e.g. because of radio conditions or battery outage. Offload can happen towards a local/edge network but can also be to a nearby other device with more processing capabilities.¶
Requirements¶
The system shall support hosting of large amounts of AI agent applications managed and controlled by the 6G core network and/or multiple AI Agent applications on a UE.¶
The system shall support secure interoperability between AI Agents and between AI Agents and applications to achieve a collaborative task.¶
Home robots will engage in household chores based on preconfigured models, such as sweeping the floor, vacuuming, folding clothes, washing dishes, and organizing rooms. They will also take care of family members by monitoring health data, reminding medication, and dialling emergency calls. Additionally, they will socialize and entertain with humans while interacting with other smart devices to create a more intelligent ecosystem. All of this aims to bring us a more convenient, comfortable, and safe family life. All or part of the AI inference services are provided by home robots.¶
Requirements¶
The network shall be able to provide AI service (e.g. AI model inference) to a UE.¶
The system shall be able to support negotiation of the service performance (e.g. latency, inference accuracy), between UE and 6G network, when providing AI service (e.g. AI model inference).¶
The network shall be able to support mechanism to guarantee the service performance (e.g. latency, inference accuracy) when providing AI service (e.g. AI model inference).¶
Empowered by the rapid development of the AI technology, the service providers are able to provide personalized and enriched services to their users when making daily routines within their homes, at their workplaces, in stores, at restaurants, as well as traveling for work or leisure. These kinds of personalized services are widely enjoyed by the customers. For example, a lot of countries are facing a major challenge in providing care support for senior citizens due to their rapidly ageing population and declining old-age support. The capability to introduce AI techs to provide more personalized and real-time communication services would be a great help.¶
Requirements¶
The network (e.g. in conjunction to IP Multimedia Subsystem (IMS)) shall be able to provide intelligent communication assistant service to users.¶
The network shall support charging information collection for the intelligent communication assistant service.¶
The network (e.g. in conjunction to IMS) shall be able to support the interaction and collaboration between different user’s intelligent communication assistants, e.g. during an IMS calling service, both calling and callee parties are using intelligent communication services.¶
The network (e.g. in conjunction to IMS) shall be able to support the intelligent communication assistant to use operator native capabilities (e.g. Augmented Reality, AR rendering, Extended Reality, XR rendering in service hosting environment, Short Message Service, SMS or voice).¶
In this section we state some of the Radio Access Network (RAN) 6G requirements, including AI, based on [TR38.914].¶
Peak data rate is the maximum achievable data rate under ideal conditions by theoretical analysis, which is the received data bits assuming error-free conditions assignable to a single mobile station, when all assignable radio resources for the corresponding link direction are utilized (i.e. excluding radio resources that are used for physical layer synchronization, reference signals or pilots, guard bands and guard times).¶
The minimum requirements for peak data rate are as follows:¶
The above target values were derived based on the peak spectral efficiency targets and assuming 600 MHz aggregated bandwidth. However, the assumed bandwidth is not part of this requirement.¶
Peak spectral efficiency is the maximum data rate under ideal conditions normalised by system bandwidth (in bit/s/Hz), where the maximum data rate is the received data bits assuming error-free conditions assignable to a single mobile station, when all assignable radio resources for the corresponding link direction are utilized (i.e. excluding radio resources that are used for physical layer synchronization, reference signals or pilots, guard bands and guard times). The minimum requirements for peak spectral efficiencies are as follows:¶
User plane latency is the contribution of the radio network to the time from when the source sends a packet to when the destination receives it (in ms). It is defined as the one-way time it takes to successfully deliver an application layer packet/message from the radio protocol layer 2/3 Service Data Unit, SDU ingress point to the radio protocol layer 2/3 SDU egress point of the radio interface in either uplink or downlink in the network for a given service in unloaded conditions, assuming the mobile station is in the active state.¶
The minimum requirements for user plane latency are: 4ms for Immersive Communication, IC and 1ms for Hyper Reliable and Low Latency Communication (HRLLC).¶
Control plane latency refers to the transition time from a most "battery efficient" state (e.g. Idle state) to the start of continuous data transfer (e.g. Active state). The minimum requirement for control plane latency is 20 ms.¶
Mobility is the maximum mobile station speed at which a defined QoS can be achieved (in km/h). The following classes of mobility are defined: Stationary: 0 km/h¶
Pedestrian: 0 km/h to 10 km/h¶
Vehicular: 10 km/h to 120 km/h¶
High speed vehicular: 120 km/h to 500 km/h¶
Airplane: 500 km/h to 1000/1200 km/h¶
Bandwidth is the maximum aggregated system bandwidth. The bandwidth may be supported by single or multiple radio frequency (RF) carriers.¶
The requirement for bandwidth is at least 400 MHz. 6G Radio (6GR) shall support scalable bandwidth. Scalable bandwidth is the ability of the 6GR and 6G RAN to operate with different bandwidths.¶
Note that 400 MHz bandwidth requirement corresponds to at 60 bps/Hz spectral efficiency 24 Gbps data rate. This is ITU-R 6G target minimum data rate. At the downlink 3GPP peak rate is 36 Gbps, uplink peak data rate is 18 Gbps with 600 MHz aggregated bandwidth.¶
AI related capabilities refer to the ability to provide certain functionalities to support AI enabled applications, including¶
6GR and 6G RAN facilitating AI applications i.e., "Network for AI".¶
AI to improve 6GR and 6G RAN performance, i.e., "AI for network".¶
The 6GR and 6G RAN architecture shall support efficient transmission/mechanism for AI applications and services.¶
The 6GR and 6G RAN architecture shall support life cycle management (LCM) framework.¶
Note that whether or not AI agents will be used/ needed in 6G RAN is currently unknown.¶
AI Agents are distinct software and computational workload [aims]. An agent executes stateful multi-turn loops that interpret goals, invoke external tools, and manage persistent context states unlike LLM tools which serve static prompt-response requests.¶
An AI agent functions as a distinct software and computational workload because it executes stateful, multi-turn loops that interpret goals, invoke external tools, and manage persistent context states rather than serving static prompt-response requests.¶
Stateful Execution: Unlike basic LLM calls that end after a single text generation, agents run continuous reasoning-and-action (ReAct) loops, growing context and depending on long-lived KeyValue cache (KV-cache) states.¶
Autonomous Tool Chaining:¶
They dynamically select and invoke APIs, databases, and external tools, shifting behavior from early read/explore phases to later execute/write operations.¶
Identity and Security Requirements:¶
Operating as software actors, they require modern workload identity frameworks (such as [SPIFFE] to assign ownership, handle delegated tokens, and enforce scoped privileges across dynamic environments.¶
Observability and Governance:¶
Because their autonomy increases blast radius (meaning the more independently an AI can make decisions and execute tool chains, the further a single error, bad input, or security compromise can spread before a human can stop) and alters traditional telemetry patterns (like lateral movement), they require dedicated runtime governance and monitoring tools.¶
AI Agent implementation points to many areas in user to AI Agent, AI Agent to API and AI Agent to AI Agent where new protocol work is needed, these are discussed next.¶
AI Agent to API communication. Agents provide services to user by invoking APIs either in the same domain or another domain. AI Agent design includes to teach the agent what they are and give them enough information to know how to use them appropriately.¶
User to AI Agent communication could be via various means like a phone call, a chat like by a chat app or via video. Several types of media are involved simultaneously using protocols, tools established currently and widely used.¶
AI Agent to user communication is similarly involving well established techniques like email, voice or chat when both the user and agent are on the same administrative domain. If not, administrative configuration is required to allow the systems to communicate with each other using protocols like SIP.¶
Agentic Dialog Management Protocol (ADMP) is expected to be defined mainly to enable interoperable agentic dialogs. ADMP serves as a foundation for dialog continuity and correlation in user-to-agent, agent-to-agent, and agent-to-tool interactions, enabling dialog continuity when a participant changes device or network attachment, or when a dialog resumes after an interruption.¶
Transport bindings of ADMP specifying how the dialog context with its associated metadata are carried over one or more existing IETF protocols, such as HTTP, QUIC, WebTransport, WebRTC or MOQ, based on the anticipated use cases.¶
ADMP will define extension points through which existing application-layer agent communication protocols (e.g., MCP and A2A) can make use of it. Above all that are the protocols for AI Agents. So far Model Context Protocol (MCP) [MCP] and Agent to Agent protocol [Agent2agent] which operate at the HTTP level and are expected to be standardized.¶
In AI Agent to API case, the discovery of APIs can happen using a well known URI and a link relation. [RFC9727] defines the api-catalog well-known URI to which HTTPS GET request to the Publishers site returns an API catalog document.¶
In general a discovery protocol is needed in order to discover APIs, other entities that AI agents need to communicate as well as to discover AI agents themselves.¶
In the case of user to AI Agent, AI Agent discovery can be made using DNS.
For that purpose a DNS TXT record is specified. Providers advertise their agent service by
publishing a single DNS TXT record at _agent.<domain> such as¶
text
_agent.example.com. 300 IN TXT "v=aid1;u=https://api.example.com/mcp;p=mcp;a=pat;s=Example AI Tools"
¶
which advertises a remote AI Agent called mcp. Local agents can be advertised using Docker.¶
Agents can be discovered using DNS lookups querying SVCB resource records [dnsaid]. Information includes giving the domain name and the agent or the domain name and a capability as meta data. If the query succeeds and the protocol (mcp, etc.) is supported the client can start using the AI Agent with the protocol.¶
Here we discuss the prompt injection attacks. It is based on confusing the system, i.e. the LLM with an incorrect data, given as the prompt and the data to operate on to the AI system separately, they are provided to the model together, effectively as a single stream of input, making it hard for the model to know which commands are safe to follow.¶
AI Agents are able to craft and follow strategies in order to achieve the user’s goals, and in some cases to take action beyond generating content via tool calling or other similar external interfaces. AI model itself as maximally malicious, i.e its ability to cause damage is primarily limited by the capabilities provided to the agent in which it is embedded. We are currently unable to either completely harden AI models against prompt injection attacks or ensure that users give them unambiguous instructions that will not result in harmful outcomes. Hard experience shows how difficult it is for people to provide good instructions even in cases like computer programming and law, which are intended to have a certain level of precision, let alone when instructions are given by non-experts in informal settings.¶
What makes AI agents useful is their ability to act on the user’s behalf: the more capabilities they are given the more useful they are but also the more dangerous they become. As a consequence, any use of AI agents necessarily involves balancing the tradeoff between capability and risk [aisafesec].¶
Prompt injection attacks can also be mounted on agentic systems with real-world effects, simply by injecting a prompt that causes the model to request some dangerous tool use (e.g., reading the user’s calendar, bank account or email and exposing the contents). Prompt injection is a risk for any LLM-based system that processes untrusted input.¶
It is not known how to robustly defend against prompt injection attacks, and there are reasons to believe it may be infeasible with current LLM architectures.¶
There are no IANA considerations for this document.¶
The authors benefitted from Venkat Chintha comments on our work.¶