IntentFrame
Most agent-to-agent delegation happens through a prompt — a paragraph that only a language model can interpret. An Agent Intent Frame replaces it with a typed JSON contract carrying the objective, the constraints the work must run under, and the criteria that decide whether the result is acceptable.
The objective still reaches the model. The constraints and the acceptance criteria reach your middleware, which can enforce them.
Four concerns, one paragraph, no enforcement point
A typical delegation between two agents:
Research the tradeoffs between approach A and B. Keep it under
400 words. Don't use any external tools. When you're done, reply
with "Final Answer:" followed by your recommendation.Four distinct concerns are collapsed into one string, and three of them have no enforcement point anywhere in the system:
- An objective, which legitimately belongs in natural language.
- An output constraint the caller cannot enforce and learns about only by inspecting the reply, after paying for it.
- A capability restriction that restricts nothing. If the receiving agent has tools bound, no code prevents their use. It is a request addressed to a model, not a policy applied to a runtime.
- A completion protocol. The literal string
Final Answer:is now load-bearing control flow, expressed in English, with no schema, no version, and no test that fails when the prompt is reworded.
A frame separates them. The objective stays natural language. The constraint becomes a value compared against policy. The restriction becomes a tool grant the runtime issues or withholds. The completion protocol becomes typed criteria evaluated against the output.
sequenceDiagram
autonumber
participant P as Planning agent
participant R as Runtime
participant M as AI model
P->>R: Request frame
R->>R: Check limits and permissions
alt Breaks a rule
{{rect:enforce}}
R-->>P: Refused. No model called, nothing spent.
end
else Allowed
{{rect:model}}
R->>M: Prompt, containing only what a model should see
M-->>R: Draft answer
R->>R: Run the acceptance checks
opt A check fails
R->>M: Try again, here is exactly what was wrong
M-->>R: Corrected answer
end
R-->>P: Result, plus what was checked and what it cost
end
end
One document, six consumers
A frame is not a prompt with a schema bolted on. Each section is read by a different layer of the runtime, and only one of those layers invokes a model. Select a field to see which layer owns it.
5 of 13 sections contribute prompt text.
The rest never call a model.
Five properties you cannot get from prose
Refusal before invocation
Constraints are data, so admission control compares them against deployment policy in ordinary code. A frame requesting side-effecting tools its capability is not entitled to is refused with a typed violation list and zero model invocations. The enforcement point exists, and it is not the model.
Deterministic dispatch
intent_type is a closed enum, so the runtime derives model, temperature, tool grant, and validation pipeline from the frame alone. A verify frame can be pinned to temperature zero on an independent model with every tool stripped, without a word of prompt text changing.
Machine-checkable completion
Acceptance criteria are typed checks rather than English. A result satisfies its contract or it does not, and the finding is specific enough to drive the next attempt without a human writing a retry prompt.
Meaningful telemetry
Retry rate, refusal rate by rule, and cost per capability all become group-by queries once intent is a field. Aggregate invocation counts average together operations with nothing in common; "verify frames retry 31% of the time" is actionable.
Replayable execution
Every branch is taken on a typed value — a policy verdict, a validation report, an attempt counter — never on the contents of model output. A run can be reconstructed from its event log rather than reread as a transcript.
Where this earns its cost
Six worked examples, each with the frame that would be sent and the failure it forecloses.
Customer support
The drafting agent holds the full account record and the prompt asks it not to quote card numbers. At production volume, a compliance rate is an incident count. Read →
DevOps and SRE
Your triage agent is nominally read-only and holds the same Kubernetes client as the remediation agent. Ask what actually prevents it acting. Read →
Regulated documents
The blocker in banking and healthcare is rarely model quality. It is being unable to evidence, afterwards, which controls applied. Read →
Code review
The reviewing agent is usually the same model at the same settings that wrote the code, and it approves accordingly. Read →
Data and analytics
Generated SQL with no scan ceiling and no check that the statement is read-only. Both failures are expensive. Read →
Document extraction
Near-valid JSON, a hallucinated field, 1,800 parsed as 18,000 — accepted downstream because nothing validated it. Read →
A layer, not a framework
IntentFrame moves no bytes and runs no agents. Keep LangGraph, CrewAI, or whatever you already run. It occupies the position OpenAPI occupies on the web: a contract both sides validate against, independent of what executes underneath.
If you already send tasks over A2A, a frame travels inside one as a data part. The two compose; they are not alternatives.
| Agent stack | Concern | Web analogue |
|---|---|---|
| Agent logic | Reasoning, tool use | Application code |
| Intent frame | The semantics of a single interaction | OpenAPI, JSON Schema |
| Discovery | Which agent does this, and where is it — out of scope | Service registry |
| Transport | Discovery, delivery, task lifecycle — A2A | HTTP |
flowchart TB
subgraph AS["Agent stack"]
direction TB
A1["Agent logic<br/>reasoning, tool use"]
A2["Intent frame<br/>semantics of one interaction"]
A3["Discovery<br/>out of scope · use A2A"]
A4["Transport<br/>delivery, ordering, retries"]
A1 --- A2 --- A3 --- A4
end
subgraph WS["Web analogue"]
direction TB
W1["Application code"]
W2["OpenAPI, JSON Schema"]
W3["Service registry"]
W4["HTTP"]
W1 --- W2 --- W3 --- W4
end
A2 -.the missing layer.-> W2
class A1,W1 context
class A2,W2 model
class A3,W3 route
class A4,W4 observe
A frame does not improve reasoning, reduce hallucination, or establish whether a claim is true. It can require that a summary contain a recommendation section; it cannot make the recommendation sound. Every problem in scope here is an interface problem.
Deliberately not a discovery mechanism
IntentFrame specifies the terms of one request. It does not specify how a caller finds a receiver, how the message travels, or how either side authenticates. Those are solved, and solved better elsewhere.
If you run A2A, declare each capability as an A2A Skill and let the frame ride in the message's data part. If you don't, use whatever service registry you already operate. Frames address a capability such as research.summarize rather than an agent instance, so replacing the implementation behind a name leaves callers unaffected — but resolving that name to an endpoint is your infrastructure's job, not this specification's.
Nor does the library ship a registry. A receiver already knows which capabilities it supplies, which intent types it accepts, and which inputs it needs; those checks belong in its own handler, not in a shared abstraction this project would have to version.
How this maps to A2A Skills → · Skill and frame, side by side →
Reference library
agentintentframe · Python
Admission control, artifact resolution, intent dispatch, typed validation, validator-driven repair, and per-intent telemetry. The core depends only on pydantic; framework adapters are extras and import lazily. Documentation →
pip install agentintentframeFramework adapters
LangGraph exposes each layer as a graph node, so the frame lifecycle appears in existing tracing and checkpointing. CrewAI integrates at the executor seam, leaving admission, validation, and repair outside the crew. Anything else integrates through one callable. Adapters →
Contribute
This is a draft, and implementation experience is what will improve it. Frame builders, validators, policy engines, and transport bindings are all in scope. Open an issue →
IntentFrame was initiated by Manikanta Panati. The specification, reference implementation, and this site were developed with AI assistance; the design decisions, scope, and editorial judgement are the author's.
Published for comment. Version 0.1 will change in response to implementation experience; breaking changes increment the major version, and every frame records the version it was written against.