A Consent Layer for Cross-User Agent Interaction
Active research — paper in progress.
The gap
AI agent communication protocols are maturing quickly. Google’s A2A, the Agent Network Protocol, and NLIP address how agents discover each other, verify identity, and exchange messages. Multi-agent frameworks handle orchestration of agents working together.
But these systems share a common assumption: agents either serve the same user, or the interaction is a simple service request. They don’t address the scenario where Agent A represents User A and Agent B represents User B, and the two agents must negotiate while respecting each user’s distinct boundaries, consent requirements, and interests.
This is a fundamentally different problem. Single-user multi-agent systems share context freely and assume aligned interests. Cross-user agent interaction requires selective disclosure, consent-gated information sharing, and negotiation between potentially competing goals — with humans in the loop at the right moments.
Existing protocols handle the mechanics of agent communication but not the governance: what agents are allowed to do on behalf of their users, how consent flows through interactions, and how accountability is maintained.
What we’re developing
A protocol-agnostic consent and negotiation layer that sits between application logic and communication transport. The architecture introduces five components:
- Boundary Manifests — structured representations of what an agent is authorized to do on behalf of its user, distinct from what it’s capable of doing
- Consent Propagation — first-class consent records with states, delegation chains, and revocability
- Negotiation Semantics — interaction patterns for agents with competing interests, with human-in-the-loop at calibrated decision points
- Selective Disclosure — graduated information sharing controlled by boundary manifests, sharing the minimum necessary for each exchange
- Adaptive Boundary Learning — boundaries learned from real user decisions over time, not configured upfront through hypothetical questionnaires
The layer is designed to complement existing protocols (A2A, ANP, NLIP), not replace them.
Why this matters now
As agents become more capable, the bottleneck shifts from what agents can do to what agents should be allowed to do. Recent research has demonstrated that baseline agent communication protocols leak the majority of sensitive data against adversarial attacks — fixable with consent mechanisms, but those mechanisms don’t yet exist at the protocol level.
Without a consent and negotiation layer, cross-user agent interaction remains either unsafe (agents share too much) or useless (agents can’t share enough to be helpful).