AgentInit: Bootstrap in Agent Systems

• AgentInit is a systems-level initialization layer that turns a specification into an operational agent by managing identity, discovery, and secure communication.
• It integrates decentralized naming, DID-based identity, and federated governance to ensure trusted onboarding, secure channel setup, and proper authorization.
• In LLM-based multi-agent systems, AgentInit orchestrates role generation and team composition to balance expertise and optimize collaborative efficiency.

AgentInit is an emerging term in agent systems research for the initialization and bootstrap phase that turns an agent, agent service, or multi-agent system from a specification or endpoint into an operational participant. Across recent work, the term spans several technical layers: topology-independent naming and discovery, decentralized identity establishment, secure channel setup, authorization issuance, governed onboarding, tool and environment registration, and team composition for collaborative large-language-model systems (Rodriguez, 21 Jan 2026). The literature does not treat AgentInit as a single standard; rather, it appears as a family of initialization procedures adapted to different substrates, including agent naming schemes, Agentic Web protocols, governed trust layers, domain-specific operational stacks, and role-generation pipelines for multi-agent reasoning (Chang et al., 18 Jul 2025).

1. Scope and conceptual framing

In protocol-oriented work, AgentInit is the early lifecycle by which an agent becomes identifiable, discoverable, authenticated, authorized, and ready for interaction. The ANP white paper defines AgentInit as the initialization and bootstrap process by which an ANP-compliant agent establishes its identity and secure communications, negotiates meta-protocols, and activates application-level protocols to become operational on the Agentic Web (Chang et al., 18 Jul 2025). ACP places AgentInit at the early stages of a larger lifecycle—bootstrap, discovery, negotiation, session establishment, execution, and monitoring—while OAN describes it as the governed, evidence-carrying workflow that moves an agent from a self-described endpoint to a discoverable, admissible, and verifiably invokable participant (Krishnan, 11 Feb 2026).

A second usage treats AgentInit as the point where authority is made explicit and machine-evaluable. Work on portable authorization for autonomous agents argues that identity alone is insufficient and that initialization must bind agent identity, issuer identity, explicit permissions, typed constraints, revocation, and deterministic evaluation semantics into a portable authorization payload (Madhira, 12 May 2026). OpenID Foundation guidance generalizes the same concern into a lifecycle view spanning provisioning, operation, rotation, revocation, and de-provisioning, with particular emphasis on delegated authority, actor-subject separation, and auditability for non-deterministic agents (South et al., 29 Oct 2025).

A third usage appears in LLM-based multi-agent systems, where AgentInit refers not to network bootstrap but to the generation and selection of collaborating roles. In this line of work, initialization determines which agents exist, what expertise they embody, and how they divide labor, with downstream implications for repetition, redundancy, token use, and task completion quality (Tian et al., 23 Sep 2025). This broader distribution of meanings suggests that AgentInit is best understood as a systems-level initialization layer whose exact semantics depend on whether the research focus is networking, trust, authorization, operational deployment, or collaborative cognition.

2. Identity, naming, and discovery substrates

One of the clearest formulations of AgentInit as an identity substrate is the "agent://" URI scheme, which separates naming from addressing by representing identity as $I = (R, C, U)$, where $R$ is the trust root, $C$ the hierarchical capability path, and $U$ the sortable unique identifier. The canonical form is agent://<trust-root>/<capability-path>/<suid>[?query] [#fragment], and query and fragment are explicitly excluded from identity comparisons. Discovery is capability-based rather than endpoint-based, using the DHT key

$$k = \mathrm{SHA256}\big(\mathrm{canonical}(R)\ \Vert\ "/" \Vert\ \mathrm{canonical}(C)\big),$$

with Kademlia resolution in $O(\log N)$, trust-root scoping, prefix semantics over capability paths, and formal migration invariance because endpoints may change without changing $I$ (Rodriguez, 21 Jan 2026). The reported evaluation gives 100% coverage on 369 production tools with 0% collision, $\mathrm{F1}=1.0$ across 10,000 agents and 1,000 queries, and local operations under 5 microseconds (Rodriguez, 21 Jan 2026).

ANP adopts a different identity model centered on W3C decentralized identifiers, including did:web and did:wba (Web-Based Agent). In its Layer 1 model, an agent’s identity can be viewed as a tuple $I = (did, D, K)$, where $did$ is the decentralized identifier, $R$0 the DID document containing verification methods and public keys, and $R$1 the set of private keys controlled by the agent. DID documents provide the verification substrate for signatures and encrypted communication, while discovery and capability advertisement are handled separately through ADP in JSON-LD and an Agent Discovery Protocol with a .well-known/agent-descriptions path and pagination via a next field (Chang et al., 18 Jul 2025).

ACP and OAN further extend discovery into federated and governed environments. ACP defines a core tuple

$R$2

combining agent entities with DIDs, message schemas, protocol flows, security policies, registries, and a JSON-LD ontology of intents and capabilities. Discovery may be local, via mDNS-style broadcast, or global, via a DHT plus consortium chain, and leads directly into identity verification and SLA negotiation (Krishnan, 11 Feb 2026). OAN adds a stronger governance layer: Root nodes authorize Registrars and Discovery nodes, accept or reject identity versions, publish Root-verified packages, and anchor infrastructure authorization events to a blockchain-backed bulletin. Discovery nodes synchronize packages through CDN, enforce capability-domain scope, and return signed responses carrying package references, Root proof, and bulletin authorization context (Xu, 2 Jun 2026).

These designs reflect distinct architectural priorities. The agent URI scheme restores the name/address distinction for agents and makes capability discovery intrinsic to identity naming (Rodriguez, 21 Jan 2026). ANP treats identity as decentralized Web-compatible attestation plus protocol negotiation substrate (Chang et al., 18 Jul 2025). ACP and OAN place greater emphasis on inter-organizational orchestration, discovery policy, and evidence-bearing first contact (Krishnan, 11 Feb 2026).

3. Trust, authorization, and governance semantics

A central theme in AgentInit research is that identity without bounded authority is inadequate. In the agent URI scheme, capability claims are bound to agent identity through PASETO v4.public tokens using Ed25519, with claims such as iss, sub, aud, iat, exp, and capabilities. Verifiers fetch keys from https://{R}/.well-known/agent-keys.json, validate tokens without real-time contact with the issuer, and check capability coverage via

$R$3

This design is intended to prevent URI spoofing, namespace pollution, replay, and unauthorized capability claims while allowing trust-root-scoped federation (Rodriguez, 21 Jan 2026).

Portable authorization work pushes this further by separating three layers: credential container, authorization payload, and enforcement engine. The portable payload contains four mandatory components—agent identity, issuer identity, permissions, and typed policy constraints—and is evaluated under conjunctive, fail-closed semantics. The type system includes Number, Timestamp, String, Set[String], and Pattern; core constraints include numeric limits, temporal windows, enumerated lists, and string patterns; and unknown constraint types or missing context fields evaluate to false by definition (Madhira, 12 May 2026). The resulting decision procedure is deterministic for fixed payload, context, mapping profile, vocabulary, and local policy, and the effective authorization region is the intersection of payload constraints and local constraints. The paper treats attenuation as a partial order over constraints, so delegation can narrow but not widen authority (Madhira, 12 May 2026).

The OpenID Foundation whitepaper addresses the same problem from an identity-management perspective. It recommends OAuth 2.1 with PKCE, OIDC, RFC 8693 Token Exchange, sender-constrained tokens through mTLS or DPoP under FAPI profiles, SCIM provisioning, PEP/PDP separation, Shared Signals, and the RFC 8693 act claim to encode the agent acting on behalf of a human sub. Its core argument is that agent-centric identity is necessary because traditional client IDs and service accounts are insufficient for cross-domain operation, least-privilege enforcement, and auditable delegation chains (South et al., 29 Oct 2025).

Task-centric access control offers a more runtime-scoped interpretation of AgentInit. AgentSentry defines permissions as bound to the current user task rather than to the agent in the abstract. A rule has the form

$R$4

with default deny. The Task Interpreter derives a TaskContext, the Policy Generation Engine instantiates a temporary PolicySet, the PEP mediates every action, and the PDP authorizes only actions consistent with the task’s semantic scope and lifetime. In the reported example, an agent allowed to read a verification email is denied an injected email-forwarding action because send/forward is خارج scope; privileges are revoked on task completion or timeout (Cai et al., 30 Oct 2025).

Governance-oriented trust layers add institutional controls above authorization semantics. OAN distributes authority across Root, Registrar, and Discovery roles, with bulletin entries for Registrar and Discovery authorization states, capability governance updates, and revocations. Verification composes multiple evidence objects—registration credential, Root acceptance, bulletin proof, signed discovery response, and invocation envelope—into a trust-evidence chain before business traffic begins (Xu, 2 Jun 2026). ACP similarly adopts a zero-trust posture through DID-based authentication, VCs, signed messages, proof of intent, SLA scopes, and heartbeat-driven policy compliance (Krishnan, 11 Feb 2026).

4. Session bootstrap, protocol negotiation, and operational readiness

Several AgentInit designs treat secure session establishment as a first-class concern. ANP organizes initialization into three layers: identity and encrypted communication, meta-protocol negotiation, and application protocol activation. The identity procedure uses DID and signatures in HTTP headers during the first request, server-side DID document resolution, token issuance for subsequent requests, and ECDHE-based end-to-end encryption so that intermediate nodes cannot decrypt the communication content. The cryptographic core is expressed as

$R$5

and

$R$6

with TLS 1.3 cited as the transport reference (Chang et al., 18 Jul 2025). Meta-protocol negotiation then determines request formats, interface calling methods, and session strategies through natural-language or structured exchanges, and Layer 3 activates interfaces discovered through ADP JSON-LD documents (Chang et al., 18 Jul 2025).

ACP formalizes a comparable but more federated process. After discovery, peers exchange DID documents, verify challenge-response signatures over nonces and context, present VCs, map JSON-LD intents to compatible plans, negotiate SLA terms, establish transport over gRPC, WebSockets, or HTTPS with TLS 1.3, derive a session key from ephemeral ECDHE, and begin heartbeat and readiness checks. The paper reports that discovery over the DHT is $R$7, identity verification is $R$8 per peer, negotiation typically takes $R$9–$C$0 messages, session handshake is $C$1 in 2–3 exchanges, and ACP reduces inter-agent communication latency by 40% while maintaining a zero-trust security posture. Under high-load conditions, the reported benchmarks are 145 ms average latency and 88% success rate for JSON-RPC over HTTPS, 22 ms and 99% for local MCP, and 58 ms and 96% for federated ACP (Krishnan, 11 Feb 2026).

OAN treats readiness as the endpoint of governed first contact rather than of transport negotiation alone. After discovery verification, the relying agent constructs a signed invocation envelope binding caller DID, target DID, method, path, body hash, timestamp, nonce, and provenance references. The service agent then verifies freshness, target binding, package provenance, and signature before executing business logic, and responds with its own signed envelope (Xu, 2 Jun 2026). The protocol therefore shifts some session trust from transport-only mechanisms to object-level provenance and admission evidence.

System	Initialization focus	Distinctive mechanisms
agent://	Stable identity and capability discovery	Trust root, hierarchical capability path, TypeID SUID, DHT lookup (Rodriguez, 21 Jan 2026)
ANP	Secure communication and protocol activation	DID documents, ECDHE, meta-protocol negotiation, ADP JSON-LD (Chang et al., 18 Jul 2025)
ACP	Federated A2A orchestration	DIDs, VCs, JSON-LD intents, SLA negotiation, TLS 1.3 (Krishnan, 11 Feb 2026)
OAN	Governed admissibility and trusted invocation	Root/Registrar/Discovery roles, bulletin proofs, Root-verified packages (Xu, 2 Jun 2026)

Taken together, these systems indicate that AgentInit increasingly includes not just authentication or channel setup, but also semantic negotiation, pre-connection evidence, and explicit readiness criteria before execution begins.

5. Domain-specific operational realizations

In applied systems, AgentInit often becomes a domain-specific procedure for binding LLM runtimes to external tools, datasets, and safety controls. IntAgent, a NWDAF-based intent LLM agent for next-generation networks, defines initialization goals as loading the intent schema and prompt, establishing NWDAF and MCP connectivity, registering tools, attaching to live analytics data, and setting runtime parameters and safety gates. Its initialization sequence includes starting Ollama with Meta Llama 3.1 at Temperature = 0.1, connecting an MCP client to an MCP tools server, registering data retrieval, feasibility, KPI, monitoring, policy, session, programming, and safety tools, ensuring EES subscriptions from UPF, PCF, and SMF, confirming MongoDB collections and NBI endpoints, and restricting write-path tools to require safety approval (Soliman et al., 19 Jan 2026). The demonstrated use cases are ML-based traffic prediction and scheduled policy enforcement, including a Random Forest Regressor for slice memory utilization with reported $C$2 on the test set and a scheduled 20% AMBR increase for a streaming slice during a weekday time window (Soliman et al., 19 Jan 2026).

OptAgent operationalizes AgentInit in a building-energy setting by coupling a physics-informed machine learning digital environment with an orchestrator-specialist agent layer connected through 72 MCP tools and a shared BUS. Initialization loads PIML models, registers tools on a FastMCP server, instantiates 11 specialist agents from YAML agent cards, binds each to appropriate environment modules, sets policies for reasoning and verification, configures shared and per-agent memory, enables BUS logging, and selects an intelligence mode among centralized single-stage, centralized two-stage, and decentralized orchestration (Jiang et al., 27 Jan 2026). The benchmark covers approximately 3,975 runs over 53 standardized test cases, 25 orchestrator-specialist model pairings, and three intelligence modes. The paper reports that centralized two-stage planning is the recommended default, with average accuracies of tool 0.69, agent 0.72, plan 0.67, and parameter 0.70, orchestrator tokens around 4588, specialist tokens around 1156, planning time around 3.4 s, execution around 6.1 s, total runtime around 10.8 s, and inference cost reduced by approximately 28% versus centralized single-stage (Jiang et al., 27 Jan 2026).

These domain-specific instances show that AgentInit is not limited to trust bootstrap. In both systems, initialization also includes prompt loading, tool registry construction, schema caching, safety policy configuration, and binding to live or simulated environments. This suggests a broader systems interpretation in which AgentInit is the stage where an agent acquires both its external trust surface and its internal operational substrate.

6. Multi-agent team composition and cognitive initialization

A distinct strand of work uses AgentInit to mean the initialization of an LLM-based multi-agent team rather than the initialization of a networked agent endpoint. In "AgentInit: Initializing LLM-based Multi-Agent Systems via Diversity and Expertise Orchestration for Effective and Efficient Collaboration" (Tian et al., 23 Sep 2025), initialization is a two-stage process: Standardized Agent Generation and Balanced Team Selection.

Standardized Agent Generation uses a Planner agent $C$3, an Observer $C$4, and a Formatter $C$5. Over $C$6 rounds, the Planner decomposes the query into subtasks, drafts role descriptions, the Formatter converts them into a standardized JSON schema with fields name, description, suggestions, and prompt, and the Observer critiques duplication, specificity, necessity, prompt-template compliance, and execution-plan I/O consistency. The overall composition is

$C$7

with $C$8 as the reported default and near-optimal setting (Tian et al., 23 Sep 2025).

Balanced Team Selection then enumerates teams of size $C$9, defaulting to $U$0, and scores them on task relevance and intra-team diversity. Task relevance is the average cosine similarity between role embeddings and the query embedding,

$U$1

while diversity is measured with a Vendi score derived from the eigenvalue spectrum of the role-similarity matrix,

$U$2

Teams are filtered to the Pareto set

$U$3

and a Selector agent chooses the final team $U$4 (Tian et al., 23 Sep 2025).

The reported results show that AgentInit outperforms automated initialization baselines, pre-defined teams, and single-agent baselines across multiple frameworks and tasks. On the Complete Graph setting with Qwen2.5-72B-Instruct, the average score is 91.3 versus 90.1 for AutoAgents, 89.8 for EvoAgent, 90.0 for pre-defined teams, 90.3 for AgentPrune, 88.1 for Vanilla, and 89.3 for CoT. With DeepSeek-V3, the average is 93.7 versus 92.8, 92.5, and 92.3 for the corresponding baselines (Tian et al., 23 Sep 2025). Token usage is also reduced relative to automated alternatives: on Qwen in the Complete Graph setting, AgentInit uses 964K prompt tokens and 311K completion tokens on average, versus 1.0M and 323K for AutoAgents (Tian et al., 23 Sep 2025).

This line of work broadens the meaning of AgentInit from security and networking bootstrap to collaborative structure synthesis. It treats initialization as the point where expertise distribution and diversity are jointly optimized so that downstream interaction is both effective and efficient.

7. Limitations, trade-offs, and open problems

The literature consistently presents AgentInit as necessary but not sufficient. The agent URI scheme improves stability and decentralized discovery, but organizations must run trust-root infrastructure, manage key lifecycles carefully, and participate in a DHT; changing trust roots changes identity by design (Rodriguez, 21 Jan 2026). ANP offers a minimal DID-based path to operational readiness, but explicitly leaves unspecified exact header names, concrete cryptographic primitives beyond ECDHE and a TLS 1.3 reference, detailed negotiation algorithms, timeout and retry behavior, and re-keying schedules (Chang et al., 18 Jul 2025).

Federated trust layers introduce additional governance complexity. ACP assumes Byzantine-fault-tolerant DID registries and DHT infrastructure, and identifies future work around zero-knowledge proofs, cross-chain settlement, and standardized human-in-the-loop interrupts (Krishnan, 11 Feb 2026). OAN provides governed onboarding and authorization-aware discovery, but currently operates under a single-root trust domain; federation, privacy-preserving discovery, and stronger production hardening remain future work (Xu, 2 Jun 2026).

Authorization-focused work also foregrounds trade-offs. Portable authorization models require governed vocabularies, signed mapping profiles, revocation sources, deterministic evaluators, and fail-closed behavior, all of which improve consistency but increase integration burden (Madhira, 12 May 2026). OpenID guidance similarly notes the unresolved difficulty of scalable access control, agent-centric identity convergence, delegated authority across domains, and revocation propagation for highly autonomous systems (South et al., 29 Oct 2025). Task-centric access control prevents instruction injection, but overly narrow policies can create false denials and user friction, and the paper does not report detailed quantitative overhead or false-positive/false-negative metrics (Cai et al., 30 Oct 2025).

Applied AgentInit systems reveal analogous operational limitations. IntAgent reports that LLM hallucinations occurred regularly, likely due to smaller model size, and that the think–act–observe loop can add latency and inefficiency for simple intents (Soliman et al., 19 Jan 2026). OptAgent identifies prompt explosion under large tool registries, fragile behavior from some larger or mid-sized models, static or semi-static agent pools, and the economic limitations of rule-based controllers, motivating future work on dynamic HR-like agent generation and MPC/RL control (Jiang et al., 27 Jan 2026). In MAS initialization, embedding-based relevance and Vendi diversity remain proxies for collaboration quality, and exhaustive subset enumeration becomes costly as candidate pools grow, though NSGA-II and transfer modes partly mitigate that issue (Tian et al., 23 Sep 2025).

A plausible implication is that AgentInit is converging toward a cross-cutting architectural layer for agentic systems rather than a single protocol artifact. Across identity substrates, trust and authorization engines, governance frameworks, operational stacks, and collaborative role synthesis, the initialization phase increasingly determines not only whether agents can communicate, but also under what authority, with what evidence, through which discovery mechanisms, and in what internal configuration they enter execution.