What infrastructure must exist beyond training agents?

Chan and colleagues ("we propose the concept of agent infrastructure") argue that "much research on making agents useful and safe focuses on directly modifying their behaviour, such as by training them to follow user instructions," but that "direct behavioural modifications... do not fully address how heterogeneous agents will interact with each other and other actors." They define agent infrastructure as "technical systems and shared protocols external to agents that are designed to mediate and influence their interactions with and impacts on their environments," explicitly modeled on internet protocols: "Just as the Internet relies on infrastructure like TCP..., HTTPS..., and BGP..., we argue that agent infrastructure will likely be crucial for unlocking the benefits and managing the risks of agents."

The paper organizes this external layer into three functions. "Attribution is about attributing actions, properties, and other information to (instances of) agents, users, or other actors." "Interaction is about shaping agents' interactions with the world." And "response is about detecting and remedying harmful actions from agents." Each function covers both intra-organizational use — a business using communication protocols "to manage its agents internally, much as infrastructure like Slack and Google docs helps human employees work together" — and inter-organizational use between firms "over the internet," where adoption is harder because "different actors could use mutually incompatible communication protocols." The paper also separates infrastructure that needs widespread adoption to work — "inter-agent communication protocols are only useful if both parties can use the same protocols. Agent IDs are also only useful if other parties can recognize them" — from infrastructure "immediately useful... even if few actors adopt them," such as "oversight layers and rollbacks."

The framing complements Why do agents fail at identity verification and authorization?, which documents a standards body converging on exactly the attribution function this paper first named as a structural category rather than a patch. It also sits upstream of Does agent capability matter more than coordination infrastructure? and How do agent security layers connect across the stack?: where those describe coordination and security as bottlenecks that emerge once agents transact and act across a stack, this paper supplies the taxonomy — attribution, interaction, response — for what any such external layer must do. It differs in scope from Why do capable AI agents still fail in real deployments?: that framework asks what conditions let agents be adopted at all, while this paper assumes adoption is the goal and asks what plumbing has to exist underneath it regardless of how capable the agents become.

The excerpt is explicitly "an incomplete catalog of research directions," not an evaluation — it offers no evidence that any proposed piece of infrastructure (IDs, rollback, commitment devices) has been built, works, or would be adopted, and it flags adoption itself as contested, since incompatible systems could "benefit dominant players by shutting out potential competitors." The implication the evidence supports is narrower than "agents will get this infrastructure": it is that behavioral fixes to agents are conceptually insufficient for governance, and that the harder unsolved problem is coordinating adoption of an external layer across competing developers — which the paper's own conclusion says only a more comprehensive legal and regulatory response could resolve.