NMA Lifecycle Management YANG Data Model

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 30 April 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Network Management Agents (NMAs) are increasingly being used for network fault analysis, path optimization, change recommendations, and other network management scenarios. NMAs from different vendors represent lifecycle states and version information differently, making unified management more difficult.¶

This document defines a minimal YANG data model for NMA lifecycle management. It provides a consistent representation of instance information, lifecycle state, version state, and associated event notifications. The model can be implemented by an NMA itself or by a management adapter. Initiating and executing lifecycle operations, the internal implementation of an agent, and agent discovery protocols are outside the scope of this document.¶

2. Terminology and Conventions

This document uses the YANG 1.1 terminology defined in [RFC7950]. Configuration and operational state data follow the concepts described in [RFC8342], and the YANG tree diagram uses the notation specified in [RFC8340].¶

• NMA (Network Management Agent): A software agent instance used to perform network management tasks.¶

• NMA Management System: A system that manages NMAs using the model defined in this document.¶

3. Relationship to Existing Work

4. NMA Lifecycle Management Framework

In operator network management workflows, an NMA instance typically passes through four key management stages between introduction and retirement from production. Rather than directly issuing commands to control these stages, the ietf-nma-lifecycle model serves as a management-plane state record that captures essential configuration and operational state information at each stage:¶

1. Production Admission: After an NMA instance has been deployed and connected to the network management system, its lifecycle state is admission. At this stage, operators can use the configuration container to preconfigure the instance's operating mode (for example, initially selecting the shadow mode for passive testing and validation), permitted network scope (allowed-scope), and maximum operation risk level (max-risk-level). The instance can enter production after the external admission process has been completed successfully.¶

2. Runtime Management: An admitted NMA enters the active state. During operation, the management system can adjust its configuration policies at any time. For example, during a period of frequent faults, the NMA can be changed from autonomous to recommendation-only mode so that it presents proposed actions to on-duty operators for confirmation. The management system can also retrieve instance health and current version information through operational-state/health-status and version-state/current-version.¶

3. Version Change and Rollback: When an NMA undergoes a version upgrade or a rollback following a failure, its lifecycle state changes to changing. To avoid ambiguity during the transition, current-version continues to indicate the previous production version until the replacement has completed. When the external upgrade or rollback operation finishes, the instance reports the target version and final execution result (success or failed) through a version-change-result notification.¶

4. Planned Offboarding: When an NMA instance is no longer needed and an external process has completed its shutdown, its lifecycle-state transitions to offboarded. A lifecycle-state-change notification is also generated to support management-system archiving and auditing.¶

5. Design of the NMA Lifecycle YANG Model

module: ietf-nma-lifecycle
  +--rw agents
     +--rw agent* [agent-id]
        +--rw agent-id                       string
        +--rw name?                          string
        +--rw vendor?                        string
        +--rw description?                   string
        +--ro lifecycle-state?               lifecycle-state-type
        +--rw configuration
        |  +--rw operating-mode?             operating-mode-type
        |  +--rw max-risk-level?             risk-level-type
        |  +--rw allowed-scope?              string
        +--ro operational-state
        |  +--ro health-status?              health-status-type
        +--ro version-state
        |  +--ro current-version?            string
        +---n health-status-change
        |  +--ro new-status                   health-status-type
        +---n lifecycle-state-change
        |  +--ro new-state                   lifecycle-state-type
        +---n version-change-result
           +--ro version                     string
           +--ro result                      enumeration

6. YANG Module

The module structure is defined in accordance with [RFC7950].¶

module ietf-nma-lifecycle {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-nma-lifecycle";
  prefix nma-lifecycle;
  organization
    "IETF";
  contact
    "For inquiries, contact the authors of this document.";
  description
    "A YANG data model for NMA lifecycle identification,
     management configuration, lifecycle and version state,
     and associated notifications.
     Lifecycle actions and discovery protocols are outside
     the scope of this module.";
  revision 2026-10-26 {
    description
      "Initial revision.";
  }
  typedef operating-mode-type {
    type enumeration {
      enum shadow {
        description
          "Processes live inputs in parallel for testing
           or evaluation purposes only; outputs are logged
           for verification and do not enter active
           operational workflows or trigger network changes.";
      }
      enum recommendation-only {
        description
          "Participates in active operational workflows by
           presenting actionable recommendations to operators
           or supervising systems, waiting for explicit
           confirmation before any execution.";
      }
      enum hybrid {
       description
        "Combines autonomous execution and recommendation-based
         operation. The NMA may autonomously execute permitted
         operations according to configured policies, while
         other operations require explicit approval
         before execution.";
     }
      enum autonomous {
        description
          "Autonomously executes operations within configured
           risk and scope boundaries under applicable
           authorization policies.";
      }
    }
    description
      "Configured operating mode of an NMA.";
  }
  typedef risk-level-type {
    type enumeration {
      enum R0 {
        description "Proposed lowest risk tier.";
      }
      enum R1 {
        description "Proposed risk tier R1.";
      }
      enum R2 {
        description "Proposed risk tier R2.";
      }
      enum R3 {
        description "Proposed risk tier R3.";
      }
      enum R4 {
        description "Proposed risk tier R4.";
      }
      enum R5 {
        description "Proposed highest risk tier.";
      }
    }
    description
      "Proposed risk tiers ordered from R0 to R5. The detailed
       classification of network operations is outside
       this module.
       A configured risk tier does not grant operation
       permission.";
  }
  typedef health-status-type {
    type enumeration {
      enum up {
        description
          "The NMA is available and operating normally.";
      }
      enum degraded {
        description
          "Some NMA functions or tool bindings are impaired.";
      }
      enum rate-limited {
        description
          "NMA processing is throttled by rate limiting.";
      }
      enum down {
        description "The NMA is unavailable.";
      }
    }
    description
      "Current health status of an NMA instance.";
  }
  typedef lifecycle-state-type {
    type enumeration {
      enum admission {
        description
          "Installation, instantiation, or admission processing
           is pending completion for production use.";
      }
      enum active {
        description
          "The admitted NMA instance is serving in production.";
      }
      enum changing {
        description
          "Planned version replacement or rollback is underway.";
      }
      enum offboarded {
        description
          "The NMA has completed retirement from production.";
      }
    }
    description
      "Lifecycle state of an NMA.";
  }
  container agents {
    description
      "Top-level container for NMAs managed by the system.";
    list agent {
      key "agent-id";
      description
        "A managed NMA instance.";
      leaf agent-id {
        type string;
        description
          "Unique identifier for an NMA instance within the
           management system.";
      }
      leaf name {
        type string;
        description
          "Human-readable name of the NMA.";
      }
      leaf vendor {
        type string;
        description
          "Name of the NMA vendor or provider organization.";
      }
      leaf description {
        type string;
        description
          "Description of the NMA's purpose and function.";
      }
      leaf lifecycle-state {
        type lifecycle-state-type;
        config false;
        description
          "Current lifecycle state of this NMA instance.";
      }
      container configuration {
        description
          "Lifecycle-related management configuration.";
        leaf operating-mode {
          type operating-mode-type;
          default "shadow";
          description
            "Configured operating mode of the NMA.";
        }
        leaf max-risk-level {
          type risk-level-type;
          default "R0";
          description
            "Configured upper risk tier for operations;
             this does not replace independent operation
             authorization.";
        }
        leaf allowed-scope {
          type string;
          description
            "Configured network domain, site, or service scope
             associated with the NMA. Interpretation and
             enforcement are determined by deployment policy.";
        }
      }
      container operational-state {
        config false;
        description
          "Runtime state of the NMA instance.";
        leaf health-status {
          type health-status-type;
          description
            "Current health status of the NMA.";
        }
      }
      container version-state {
        config false;
        description
          "Version information of the NMA instance.";
        leaf current-version {
          type string;
          description
            "Version of the NMA instance currently serving
             production. During a version replacement, the value
             remains the active version until replacement
             completes.";
        }
      }
     notification health-status-change {
       description
         "Notification of an NMA health status change.";
       leaf new-status {
         type health-status-type;
         mandatory true;
         description
           "New health status of the NMA.";
      }
    }
      notification lifecycle-state-change {
        description
          "Notification of an NMA lifecycle state transition.";
        leaf new-state {
          type lifecycle-state-type;
          mandatory true;
          description
            "New lifecycle state.";
        }
      }
      notification version-change-result {
        description
          "Result of a version change or rollback.";
        leaf version {
          type string;
          mandatory true;
          description
            "Target version of the operation.";
        }
        leaf result {
          type enumeration {
            enum success {
              description "The version operation succeeded.";
            }
            enum failed {
              description "The version operation failed.";
            }
          }
          mandatory true;
          description
            "Final result of the version operation.";
        }
      }
    }
  }
}

7. Security Considerations

The YANG model defined in this document is accessed through network management interfaces such as NETCONF [RFC6242] or RESTCONF [RFC8040]. The underlying transport MUST use a secure transport protocol, such as NETCONF over SSH [RFC6242] or RESTCONF over TLS [RFC9846]. Deployments SHOULD also enable the Network Configuration Access Control Model (NACM) [RFC8341] to restrict unauthorized access.¶

The following writable data nodes in the ietf-nma-lifecycle module are particularly security-sensitive:¶

• /agents/agent/configuration/operating-mode: An unauthorized modification, such as maliciously changing this value from shadow or recommendation-only to hybrid or autonomous, could allow an NMA that has not been adequately validated to initiate changes directly in a production network.¶

• /agents/agent/configuration/max-risk-level and /agents/agent/configuration/allowed-scope: Tampering with these nodes could expand the operation risk level or scope that an NMA is permitted to handle from the management system's perspective.¶

Furthermore, unauthorized access to read-only data nodes in the module (such as /agents/agent/lifecycle-state, operational-state, and version-state) or to its three notification types could reveal the distribution of software versions and lifecycle states of NMAs in a production network. An attacker could use this information to mount targeted attacks.¶

8. IANA Considerations

This document requests that IANA register the following namespace in the IETF XML Registry:¶

• URI: urn:ietf:params:xml:ns:yang:ietf-nma-lifecycle¶

• Registrant Contact: The IESG¶

• XML: N/A; the requested URI is an XML namespace.¶

This document also requests the following registration in the YANG Module Names registry:¶

• Name: ietf-nma-lifecycle¶

• Namespace: urn:ietf:params:xml:ns:yang:ietf-nma-lifecycle¶

• Prefix: nma-lifecycle¶

• Reference: RFC XXX¶

9. Future Work

In future revisions, the authors intend to explore the following extensions based on feedback from production deployments:¶

1. Composite Version Description: An NMA's actual behavior depends not only on its software code version, but also on the versions of the underlying foundation model, prompt templates, and external toolsets (such as MCP tools). Future work will evaluate whether version-state should be extended to represent fine-grained component versions and the baseline version used for rollback.¶

2. Structured References for Risk Levels and Permitted Scope: Future work will investigate linking allowed-scope to standard network topology models (such as ietf-network) and refining the relationship between risk tiers R0-R5 and approval policies.¶

10. References

Authors' Addresses