Your agent needs a contract checked, and the checking happens somewhere else. Another company runs that service. You send the fields you pulled out of the document, their side runs the policy rules, a verdict comes back. You spend the first morning writing a careful instruction for their agent: what counts as a red flag, how strict to be, what to do with a clause that could go either way. None of it arrives. Their agent never reads your instructions. It has not seen your prompt, your memory or your tools, and it never will. Only the envelope crosses.

Only the crate crosses the fence

Think about commissioning a part from an outside foundry. You need a bracket in a metal your own shop does not pour, so you send the job out. You will never stand on their floor. You will not learn how they mix their moulding sand, how they gate the mould, how long they hold the melt. That knowledge is theirs and it stays theirs, and it is most of what you are paying for.

What you do get, before you commission anything, is a published sheet: the metals they pour, the weight range they take, the tolerances they hold, the format they want the drawing in. You choose them from that sheet, and you send a drawing that matches it. Later a crate arrives holding the part and a certificate saying which melt it came from and what it tested at.

An agent protocol built for this arrangement works the same way. Each agent publishes a card declaring its capabilities, its endpoint and the modes it supports, and the other side reads that card before starting anything. Then the work is a task, and the results are artifacts: messages, files, structured JSON, returned in one response, streamed as they are produced, or pushed later as a notification. The card, the task, the artifacts. Nothing else needs to travel.

A silence is not an approval

A working pipeline shows why the boundary earns its keep. An extractor written in Python reads a contract and pulls out the fields that are genuinely ambiguous, which is the part that needs a model. A validator written in Go receives those fields across the protocol and runs deterministic policy checks, because a rule you can state exactly should not be re-derived from scratch every time. A third agent writes the report. No shared library, no shared language, no shared repository. The card and the artifact do the work an import statement would have done inside a single codebase.

The real decision sits one step further on. The validator can time out. It can return an error. It can be down for an hour. If the coordinator reads a missing answer as a pass, you have built a system that approves contracts fastest exactly when it is least able to check them. The version that survives contact marks the task MANUAL_REVIEW and puts it in front of a person. No certificate, no assembly line: the crate goes to the quarantine rack.

That is also why artifacts need a schema and a stated lifecycle. Without one you cannot tell a finished task from a half-finished one, and free text is not a contract anybody can check.

Not seeing inside is not trust

The tempting conclusion is that opacity has made you safe. It has not. Opacity is a property of the interface. It keeps your prompts, your memory and your proprietary tools on your side of the fence, and their equivalents on theirs. It says nothing about whether the agent on the other end is who it claims to be.

The card is the clearest case. It is published by the agent itself. It is a declaration of what that agent can do, not evidence that you are allowed to ask, and not proof that the endpoint answering belongs to the organisation named on it. Authenticating that endpoint, and checking that the declared capabilities are ones somebody actually authorised, is separate work and it is yours. A card is the remote cousin of what you already write for your own agents, a contract with the environment they run in: useful, and only ever as good as the party maintaining it.

Getting two agents from different companies to cooperate was never a prompting problem. You will never audit your partner’s agent. You can only audit what comes out of it.