A FIELD BRIEFING ON NETWORK STANDARDS FOR THE AGENTIC ERA

AI-Native Networking

Inference, Automation, and the Standards That Must Catch Up

Why the network is becoming the bottleneck — and which protocols, working groups, and open standards are racing to catch up.

Vinayak Hegde

Brainy Yak Consulting LLP

A SHORT NOTE BEFORE WE BEGIN

Apocalypse of the two elephants

WHAT WE'LL COVER

Four acts, one argument

Networking infrastructure was built for humans clicking links and machines moving files. AI inference and AI agents break those assumptions — and standards bodies are sprinting to respond.

01

The pivot

Why infrastructure is shifting from training-bound to inference- and agent-bound traffic

02

The fabric

Training and inference now share a network fabric that wasn't designed for either — and who's fixing it

03

Access & content

AI preferences, bot identity, and licensing — who gets to read what, and how a site can tell

04

Automation

Agent-to-tool and agent-to-agent protocols, and the identity layer being bolted underneath them

ACT 1 — THE PIVOT

Training built the cluster. Inference is reshaping the network.

Training is a scheduled, batch, inside-the-datacenter problem. Inference — especially agentic inference — is none of those things.

TRAINING TRAFFIC

• Scheduled, predictable windows
• Bursty but bounded — runs end
• Lives almost entirely inside one fabric
• Collective ops: all-reduce, all-to-all
• Failure = restart from checkpoint

INFERENCE & AGENT TRAFFIC

• Always-on, unpredictable demand
• Latency-sensitive — users and agents wait
• Crosses the open Internet, not just one DC
• Multi-hop: agent → tool → agent → model
• Failure = a person or another agent stalls

Based on draft-akhavain-moussa-ai-network ("AI Network for Training, Inference, and Agentic Interactions"), Internet-Draft.

A FRAMEWORK FOR THE REST OF THIS DECK

Three layers of AI-native networking

Every standard we'll discuss lives in one of these layers. None of them existed in their current form three years ago.

Layer 1 — Fabric

Moving bytes between GPUs and inference nodes at the speed AI collective operations demand.

Ultra Ethernet Consortium · IETF RTGWG

Layer 2 — Access

Letting a site express, and a bot prove, what it's allowed to do with content it touches.

IETF AIPREF · Web Bot Auth WG · RSL

Layer 3 — Automation

Letting an agent reach a tool, and an agent reach another agent, without N×M custom glue.

MCP · A2A · AGNTCY · IETF WIMSE/OAuth

LAYER 1 — FABRIC

The fabric wasn't built for this

• Distributed training and disaggregated inference now share clusters of 100,000+ accelerators, moving collective operations across the fabric in microseconds.
• Classic RDMA* over Converged Ethernet (RoCEv2) was retrofitted onto a transport designed for ordered, single-path delivery — it has no native multipathing or AI-aware congestion control.
• Inference increasingly spans more than one datacenter, pushing RDMA traffic onto the WAN — a path the original RDMA stack never anticipated.
• A Side note – NVIDIA (through Mellanox acquisition) build the full stack — GPU (compute) + NVLink/NVSwitch (intra-node) + InfiniBand/Ethernet (inter-node) — as a vertically integrated system, rather than depending on a third party for the networking layer. NVLink is proprietary while in Infiniband market NVIDIA is a concentrated player.
• * RDMA (Remote Direct Memory Access)

1,000,000+

endpoints a single AI fabric must scale to, per Ultra Ethernet Consortium design targets

OUT OF ORDER, ON PURPOSE

The fabric standards now emerging drop the requirement that packets arrive in order — trading strict ordering for multipath speed, then reassembling at the edge.

See next slide for the Ultra Ethernet Consortium and related IETF RTGWG work.

LAYER 1 — FABRIC STANDARDS

Two efforts, two bodies, one problem

Open standard — outside the IETF

Ultra Ethernet Consortium (UEC)

• A Linux Foundation–governed consortium (100+ member companies) — not an IETF working group.
• Published UE Specification 1.0 (2025) and 1.0.1 (Sept. 2025); purpose-built "AI Base" and "AI Full" traffic profiles for training + inference.
• Drops in-order delivery for multipath speed; replaces InfiniBand-style verbs with a UE Libfabric mapping.
• 2026 priority: Programmable Congestion Management — a standard language for pluggable congestion algorithms.

IETF in parallel

RTGWG: notifications for AI/RDMA over WAN

• draft-ietf-rtgwg-net-notif-ps-02[1]: problem statement for fast network notifications, motivated explicitly by distributed LLM training/inference traffic.
• draft-hzh-fantel-wan-tunnel-03[2]: frames how AI servers' RDMA traffic gets tunneled (GRE/VXLAN/MPLS/SRv6) across a WAN between datacenters.
• Both are early-stage IETF Routing Area documents — informational/problem-statement, not yet standards-track.

1. https://datatracker.ietf.org/doc/draft-ietf-rtgwg-net-notif-ps/
2. https://datatracker.ietf.org/doc/draft-hzh-fantel-wan-tunnel/

LAYER 2 — ACCESS & CONTENT

Every client might be a bot now

The web's oldest automation contract — robots.txt — was built in 1994 to say "please don't crawl this." It has no concept of training, no identity check, and no enforcement.

It's binary

Allow or disallow a path — no way to say "index this, but don't train on it."

It's unauthenticated

User-Agent strings are self-reported text. Anyone can claim to be Googlebot.

It's advisory

Compliance is voluntary. RFC 9309 defines the syntax, not consequences.

RFC 9309, Robots Exclusion Protocol (Koster, Illyes, Zeller, Sassman; Sept. 2022).

LAYER 2 — ACCESS & CONTENT

Every client might be a bot now

So What’s the alternative now?

AI

Ai.txt / llms.txt

Attempts at more granular, purpose-based permissions (no-training, no-inference, allow-RAG style tags), though adoption is still early and no country legally mandates them yet

W3C

TDMRep

A W3C-track standard embedding text-and-data-mining permissions into HTTP headers, with some legal weight in the EU under the AI Act

CDN

CDN-level and commercial controls

Cloudflare and others now offer one-click AI-crawler blocking and pay-per-crawl licensing, effectively moving the conversation from "allow/deny" toward "license"

https://www.w3.org/community/reports/tdmrep/CG-FINAL-tdmrep-20240510/

LAYER 2 — IETF STANDARD IN PROGRESS

AIPREF: a vocabulary for AI preferences

IETF AI Preferences (AIPREF) Working Group — chartered January 2025, after the IAB AI-CONTROL workshop flagged the gap between publishers and AI trainers.

draft-ietf-aipref-vocab

Vocabulary: defines categories like train-ai and search with simple y/n values. Proposed Standard track — active, but author notes it lacks full consensus yet.

draft-ietf-aipref-attach

Attachment: a Content-Usage HTTP header and a matching robots.txt rule, using longest-prefix matching like Allow/Disallow. Milestone: standards-track spec to the IESG, Aug. 2026.

EXAMPLE SIGNAL

Content-Usage: train-ai=n

robots.txt: Content-Usage: /ai-ok/ train-ai=y

EXPLICITLY OUT OF SCOPE

Technical enforcement · authenticating crawlers · preference registries · auditing/transparency. AIPREF declares a preference — it does not check or compel compliance.

1. https://datatracker.ietf.org/doc/draft-ietf-aipref-vocab/

2. https://datatracker.ietf.org/doc/draft-ietf-aipref-attach/

LAYER 2 — IETF STANDARD IN PROGRESS

Web Bot Auth: proving who's knocking

A chartered IETF working group (co-chaired by David Schinazi and Rifaat Shekh-Yusef, following a BoF at IETF 123) building cryptographic identity on top of RFC 9421 HTTP Message Signatures.

1. Sign

A crawler operator generates a keypair and signs each request's headers with the private key.

2. Publish

The public key is published at a well-known directory URL, per draft-meunier-http-message-signatures-directory.

3. Verify

The receiving site checks the signature against the published key — per draft-meunier-web-bot-auth-architecture.

Already in production: Cloudflare, Anthropic, OpenAI and Google have deployed it ahead of standardization. Milestones: auth spec to the IESG by Apr. 2026; key-management BCP by Aug. 2026; RFC possible 2027.

LAYER 2 — OPEN STANDARDS OUTSIDE THE IETF

Where preference meets payment

AIPREF

IETF (chartered WG)

Declare

A common vocabulary for stating preferences in an HTTP header or robots.txt

Web Bot Auth

IETF (chartered WG)

Identify

Cryptographic proof of who is making a request, built on RFC 9421

RSL (Really Simple Licensing)

RSL Collective (nonprofit, outside IETF)

License & charge

XML licensing vocabulary plus the OLP (OAuth2-based) and CAP protocols for paid/attributed access

Content Signals Policy

Cloudflare (outside IETF)

Signal at the CDN edge

Extends robots.txt-style signaling, enforceable directly at the network edge

RSL 1.0 (rslstandard.org); Cloudflare Content Signals Policy. Neither requires IETF process; both interoperate with robots.txt / RFC 9309.

LAYER 3 — AUTOMATION

Agents are now a class of network client

An agent doesn't just fetch a page. It calls tools, calls other agents, and waits on all of them — two integration problems that needed two different protocols.

VERTICAL

Agent → Tool

One agent reaching down into a database, file system, or API. Without a shared protocol, this is an N×M problem: every model × every tool needs custom glue.

Solved by: Model Context Protocol (MCP)

HORIZONTAL

Agent → Agent

Agents built by different vendors discovering each other's capabilities and delegating tasks across organizational boundaries.

Solved by: Agent2Agent Protocol (A2A)

[Opensourced by Anthropic]

[Opensourced by Google]

LAYER 3 — OPEN STANDARD OUTSIDE THE IETF

MCP: from one company's spec to shared infrastructure

• Introduced by Anthropic, November 2024, to solve the N×M agent-to-tool integration problem.
• Donated to the Agentic AI Foundation (AAIF) — a directed fund under the Linux Foundation — in December 2025; co-founded with OpenAI and Block.
• Governed by Lead/Core Maintainers and Working Groups, with changes proposed as Specification Enhancement Proposals (SEPs) — not a single-vendor roadmap.
• 2026 roadmap priorities: a stateless Streamable HTTP transport that scales horizontally, a Tasks primitive for long-running work, and enterprise-grade auth.

~97M

monthly SDK downloads by spring 2026 — up from ~2M at launch

WHO'S AT THE TABLE

Anthropic, OpenAI, Google, Microsoft and GitHub all sit on the steering structure; AWS, Cloudflare and Bloomberg back the AAIF as members.

LAYER 3 — THE REST OF THE AUTOMATION STACK

A2A, AGNTCY, and who an agent says it is

A2A

Google, Apr. 2025 → Linux Foundation, Jun. 2025. 150+ supporting organizations and v1.0 reached in early 2026. Handles agent discovery and delegation across vendors.

AGNTCY

Cisco's open infrastructure project, also under the Linux Foundation. Adds directory, identity, SLIM messaging, and observability so A2A agents and MCP servers can find each other.

WIMSE (IETF)

Workload Identity in Multi-System Environments — a chartered IETF working group defining how a workload (including an agent) proves who it is, service to service.

Bridging identity to authorization

draft-klrc-aiagent-auth (co-authored by AWS, Zscaler, Ping Identity, Defakto Security, OpenAI, Okta) composes WIMSE + SPIFFE + OAuth 2.0 rather than inventing a new protocol. The IETF OAuth Working Group is meanwhile drafting transaction tokens for agents and a client ID metadata document — both still Internet-Drafts.

https://datatracker.ietf.org/wg/wimse/about/

SYNTHESIS

Where the standards are still behind

Preference ≠ enforcement

AIPREF can express "don't train on this" — but enforcement, authentication of crawlers, and auditing are explicitly out of its charter.

Identity is a patchwork

At least half a dozen individual drafts (klrc-aiagent-auth, ni-wimse-ai-agent-identity, liu-oauth-a2a-profile…) compose OAuth/WIMSE differently — the authors themselves flag duplicated effort.

No shared cost layer

Agent-initiated payments (x402, Universal Commerce Protocol) and cross-org cost governance are real but very early; nothing here is IETF standards-track yet.

Clock speed mismatch

Deployment moves in weeks (Web Bot Auth went to production before its WG milestones); IETF process targets RFC publication in 2027.

WHAT TO TRACK

The network is catching up. Build for where it's going.

Watch the milestones

AIPREF's IESG submission (Aug. 2026), Web Bot Auth's auth spec (Apr. 2026) and BCP (Aug. 2026).

Build on governed protocols

Prefer MCP and A2A under Linux Foundation / AAIF governance over single-vendor forks.

Design the identity layer now

Adopt WIMSE/SPIFFE patterns for agents before a fragmented draft becomes your production dependency.

Treat the fabric as a 2026–27 build

Ultra Ethernet and IETF RTGWG work are real, but early — plan migrations, don't assume drop-in compatibility.

AI-Native Networking Briefing