When Agents Talk to Each Other, Someone Has to Be Accountable
A customer asked whether their agent could talk directly to their supplier's agent. Technically yes, and the interesting question is not the protocol. It is who answers when the order that comes out of the exchange is wrong.
The Request
Two companies, a recurring procurement relationship, and an idea that is genuinely reasonable: instead of a person emailing a supplier to ask about lead times and then placing an order, let an agent on each side handle the exchange.
The volume justifies it, the task is bounded and the parties trust each other commercially. Our answer was yes with conditions, and the conditions are the whole content of this piece.
The Failure That Is New
In a normal integration, a wrong result has a cause you can find: a field was misread, a rule was wrong, a version mismatched. Between two agents, the wrong result can arise from an exchange where both sides behaved plausibly and neither can show why.
Our customer cannot see the supplier's prompt, model or internal state, and the supplier cannot see theirs. Each has a transcript of what was said, which is a record of the conversation and not a record of the reasoning, and that gap is where accountability disappears if nobody designs it in.
The Research on Doing It Safely
Habler and colleagues published work in April 2025 on building a secure agentic application using an agent-to-agent protocol, addressing authentication, authorisation and the trust boundary between parties rather than the message format alone.
That emphasis matches ours. The protocol question is the easy one; the interesting design work is at the boundary, where two systems with different owners, different risk appetites and different auditors have to produce a shared record of what was agreed.
| What crosses the boundary | What does not |
|---|---|
| A structured request with an identifier | Free-form conversation |
| A structured response and a reference | Reasoning or internal state |
| A signed record of what was agreed | Anything unlogged |
| Escalation to a named person | Autonomous commitment above a limit |
What We Built Instead
Not a conversation. Each side exposes a small set of operations with structured requests and responses, and the agents use those operations. The agent decides what to ask and when; the wire carries a request for a lead time on a part number, not a paragraph of natural language.
That makes the exchange auditable by construction. Every message is a record with fields, both sides keep the same record, and a disagreement about what was agreed is settled by comparing two logs rather than by interpreting two transcripts.
The Limit That Made It Acceptable
An agent can commit to an order below a value threshold and within a set of pre-agreed parts. Above either, it produces a proposal that a named person on the buying side confirms. That is not a technical constraint, it is a commercial one, and it was agreed between the two companies before we built anything.
The threshold does most of the work. It means the autonomous path handles routine volume where a mistake is cheap and recoverable, and the exceptional cases, which is where an agent misreading a situation would be expensive, still involve someone who can be asked what they intended.
What Both Sides Record
Three things, and both sides record all three: what was requested, what was answered, and which version of each side's system produced it. That last one is the part usually forgotten and the part that matters six months later, when a dispute is about behaviour that has since changed.
We also require that either side can replay a past exchange against its current system and see whether the answer would differ. That is cheap to build at the start and effectively impossible to retrofit, which is why it is in the first version rather than on a roadmap.
Where We Said No
A proposal to let agents negotiate price. Both companies were enthusiastic and it is the clearest case we have seen of a task that is technically feasible and organisationally unwise: the outcome is contested by design, the reasoning is invisible, and the record shows what was agreed without showing why anyone agreed to it.
We suggested a narrower version, where agents exchange volumes and dates and a person approves the resulting price. That is less impressive and it keeps the decision with someone who can explain it, which is the property that matters when the relationship is under strain rather than when the demonstration is going well.
What We Do Not Claim
We do not claim agent-to-agent exchange is unsafe. Ours has run for months on routine procurement and has been unremarkable, which is the intended outcome. The claim is that the safety comes from bounded operations, value limits and shared records, not from the protocol.
We also do not claim our arrangement scales to many parties. It rests on two companies agreeing terms bilaterally, and a marketplace with dozens of counterparties would need something else, which we have not built and would not pretend to have an opinion about.