'Agents'' next frontier: agent-to-agent and network effects - Jean-Denis Greze, Town'

Multi-agent systems are best understood as a search problem for getting the right information into an LLM's context window, and the central challenge is appr...

By Sean Weldon

Agents' Next Frontier: Agent-to-Agent Systems and Network Effects

Abstract

This synthesis examines multi-agent LLM systems through the lens of a search problem: the challenge of populating a context window with precisely the right information before a tool call or response is generated. The theoretical ideal is a single omniscient agent with access to all world information, an outcome analogous to the Coase theorem's frictionless bargaining state, but one obstructed by privacy and security constraints functioning as irreducible transaction costs. Five architectural strategies for cross-silo information sharing are analyzed - trust boundary access, custom privacy-power tradeoff tools, shared silos with sweeper agents, human-as-conduit protocols, and black-box mediation - and evaluated on whether they scale automatically with model capability or require ongoing human design. Failure modes including prompt injection and wiki poisoning are identified, alongside a proposed "auto mode" trajectory for privacy delegation. Findings suggest sweeper-agent architectures and bounded black-box designs offer the most promising paths toward scalable, trust-preserving multi-agent information sharing.

1. Introduction

Discussion of multi-agent systems typically centers on orchestration topologies, message-passing protocols, and role specialization among discrete agents. The thesis advanced here reframes this discussion: multi-agent systems are fundamentally a search problem, in which the purpose of any agent-to-agent interaction is to move information across an organizational or personal boundary and into a context window precisely when it is needed.

Three terms structure this analysis. Context population refers to the mechanism by which information reaches the model, whether through manual insertion, retrieval, or autonomous search. Agentic search denotes the pattern in which an agent is equipped with multiple search tools spanning heterogeneous content spaces and autonomously issues queries until context is sufficient. An information silo is any repository whose access is bounded by trust considerations - an individual's inbox, a team's internal wiki, a company's customer relationship management system.

The central research question follows directly: if a single agent with access to all the world's information in one context window represents the natural and ideal state of computation, what architectures best approximate that state while respecting the privacy and security boundaries that render it practically unattainable? This analysis proceeds by first establishing the theoretical framing (Section 2), then evaluating five distinct sharing strategies against a common evaluative criterion - whether the design improves automatically as underlying models improve, or whether it ossifies into a static structure requiring continued human intervention (Section 3). Technical implementation patterns are then extracted (Section 4), followed by discussion of failure modes and a proposed trajectory for automating privacy decisions (Section 5).

2. Background and Related Work

2.1 The Evolution of Context Population

Three phases characterize how information has historically reached LLM context windows. Manual population, roughly four years prior to this analysis, required humans to copy relevant material directly into prompts. Retrieval-augmented generation (RAG) and search tools, emerging roughly two years prior, introduced a retrieval layer that selected passages on the model's behalf. Agentic search, the current paradigm, grants the model a suite of search tools across heterogeneous content spaces, allowing it to iteratively determine what to retrieve before acting. This trajectory reflects progressive delegation of the search decision from human to model, and multi-agent architecture represents the next increment - one in which search must cross trust boundaries that a single agent cannot legitimately traverse alone.

2.2 A Coasean Framing of Privacy

The Coase theorem offers a useful analytical lens: given full information and zero transaction costs, bargaining produces an economically efficient outcome regardless of initial allocation. Applied to agent systems, an agent with complete information and no friction in obtaining it would produce optimal decisions. Privacy and security requirements function as irreducible transaction costs, preventing full information aggregation by design rather than by accident. The engineering problem, therefore, is not the elimination of these costs but the minimization of the efficiency loss they impose.

3. Core Analysis

3.1 Static Approaches: Trust Boundaries and Custom Tools

Two early-generation strategies address privacy through fixed, human-designed structures. Trust boundary access grants an agent permissions equivalent to a specific role or relationship - for example, spouses sharing agent access to both email accounts, or an HR team agent operating with the access level of the lowest-ranking HR employee. This approach is popular among IT and security teams because it mirrors familiar SaaS security models. However, it "creates a new silo cuz a human thought about it" rather than eliminating silos, and it does not reduce reliance on human oversight over time nor improve automatically as underlying models advance.

Custom privacy-power tradeoff tools represent a more sophisticated but similarly static alternative. An example is a tool that scans all company Gmail accounts but returns only a derived relationship-strength score rather than raw message content, enabling use cases such as identifying who at a company is connected to a target CFO without exposing email contents. While effective for narrow use cases, this approach is manual and static: it requires humans to design each tool and explain privacy tradeoffs to every user, and it does not scale automatically with model capability.

3.2 Dynamic Approaches: Sweeper Agents and Human Conduits

Shared silos - repositories such as codebase skill libraries or shared wikis - accumulate value over time as private information is selectively promoted to public or team-wide spaces. The sweeper AI architecture formalizes this promotion process: an AI agent operating within each private silo maintains a policy specifying what must remain private and possesses knowledge of the schema of shared spaces, then moves appropriate information into those shared spaces. Two mechanisms govern this decision: requesting human approval before each transfer, or allowing the LLM to enforce the privacy policy autonomously. It is predicted that automatic policy enforcement will become common within smaller, high-trust organizations (10-50 employees) within six months, while adoption in large enterprises will lag considerably.

By contrast, the human-as-conduit model - in which one agent queries another and a human approves disclosure - represents the traditional agent-to-agent paradigm. Its principal limitation is inefficiency for narrow queries: a query intended for a small number of relevant individuals can inadvertently notify an entire organization (e.g., pinging 100 employees) when only a handful possess relevant information.

3.3 The Black Box Approach

The black box approach addresses the human-as-conduit inefficiency directly. Here, an LLM with full access to all private silos processes a query without exposing its reasoning trace to any party, requesting approval only from the specific individual whose data was actually used, immediately before the final tool call or disclosure. In the CFO-connection example, only the single best-connected individual is asked for consent, rather than the entire employee population. This design substantially reduces disclosure friction but requires complete trust in the black box's internal reasoning, carrying risk of inadvertent disclosure - for instance, revealing that an individual is interviewing elsewhere through recruiter-connection data.

4. Technical Insights

Several implementation patterns emerge as actionable design principles. First, agentic search architectures should expose multiple tools across content spaces, allowing the agent to iteratively query until context is sufficient rather than relying on a single retrieval pass. Second, derived-signal tools - such as a relationship-strength score - allow disclosure of useful signal without exposing underlying raw data, a pattern generalizable beyond the email-connection use case. Third, the sweeper AI architecture (per-silo agent plus privacy policy plus shared-space schema awareness) offers a scalable middle ground between full static access control and full black-box opacity, and is highlighted as the most promising single architectural idea. Fourth, black-box systems must be bounded: approval requests should be scoped only to data actually used in reaching an answer, not to all data scanned, but true opacity is unworkable - some level of auditability (e.g., logging accessible to a CISO) remains necessary even in black-box designs. Trade-offs are summarized in Table 1 (conceptual): trust boundary access and custom tools are safe but static; sweeper agents and black-box systems are scalable but carry propagation and disclosure risk respectively.

5. Discussion

The five strategies analyzed collectively suggest a fault line in multi-agent system design: architectures either encode a fixed human judgment about acceptable information flow, or they delegate that judgment to the model itself. The former category (trust boundaries, custom tools) is safer in the near term but does not benefit from model capability improvements. The latter category (sweeper agents, black-box mediation) scales with model capability but introduces failure modes specific to autonomous reasoning - notably prompt injection propagating through shared silos, and wiki poisoning, wherein an incorrect factual assertion (e.g., a persistent misnaming) becomes permanently embedded once written into a shared knowledge base.

These risks carry material consequences: absent human-in-the-loop review, false or premature disclosures could plausibly result in personnel actions or litigation. This suggests that full removal of human oversight is unlikely in the near term even as automation increases, and that auditability infrastructure will remain a required companion to any black-box design.

A plausible trajectory, drawn by analogy to coding assistants' progression from approve-everything to "YOLO mode" to Anthropic-style auto mode, is that organizations will define a low-sensitivity zone within which LLM decisions require no approval, while sensitive domains remain human-gated. This design principle allows systems to scale automatically with model capability once the low-sensitivity boundary is established, without requiring redesign as models improve. Cross-company data sharing - such as investment banks sharing private company data for lending decisions - is identified as an emerging application with substantial potential value once such boundaries are reliably defined.

6. Conclusion

This analysis has argued that multi-agent LLM systems are best understood not as orchestration problems but as search problems constrained by privacy and security boundaries that function as Coasean transaction costs. Among the five strategies examined, sweeper AI architectures and appropriately bounded black-box mediation represent the most promising directions, as both are capable of scaling automatically with model improvement rather than ossifying into human-designed silos. Practically, organizations building multi-agent systems should prioritize designs that decouple privacy enforcement from static, human-authored rules, while maintaining minimal but non-negotiable auditability. Future work should address the calibration of low-sensitivity zones in auto-mode designs and the mitigation of propagation risks such as prompt injection and wiki poisoning within shared-silo architectures.

Sources

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub