AI Engineer · Published 2026-09-03

Agents' next frontier: agent-to-agent and network effects — Jean-Denis Greze, Town

Open on YouTube ↗

Summary

Overview

  • Speaker: Jean-Denis Greze
  • Channel: AI Engineer
  • Main topic: Agent-to-agent communication, network effects, and privacy-preserving strategies for LLM agents
  • Purpose: To explore how multi-agent systems and agent-to-agent network effects work, highlight the privacy-compute tradeoffs, and propose architectural strategies for future AI agent ecosystems. Jean-Denis Greze, CTO at Town, discusses the next frontier in AI engineering: agent-to-agent interactions and network effects. He reframes running agents as a search problem over context windows and outlines five key strategies for feeding the right data into LLMs while balancing power, privacy, and security in multi-agent systems.

Topic Map

Running an agent as a search problem (01:12)

  • Explanation: Reframing LLM agent execution as a search problem where the core goal is ensuring the context window has the right information right before a tool call or user response.
  • Key claims:
    • Most LLM systems are fundamentally search problems.
    • Agentic search involves giving an agent tools to search through content spaces to populate the context window.
  • Examples:
    • Human-populated context windows versus automated agentic search tools.
  • Terminology:
    • context window
    • agentic search
    • tool call
  • Why it matters: Shifts the paradigm of agent engineering from just prompting to optimizing context population across systems.

Five strategies for LLM data access and trust boundaries (04:12)

  • Explanation: Five strategies used by companies to get the right data into LLM context windows within trust boundaries.
  • Key claims:
    • Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.
    • Privacy-preserving cross-silo tools trade off power and privacy.
  • Examples:
    • Relationship strength tool that returns a score instead of raw email content.
    • Shared wikis and Airtables as shared silos.
    • Human-in-the-loop and black-box compute approaches.
  • Terminology:
    • trust boundaries
    • cross-silo tools
    • shared silos
    • human-in-the-loop
    • black-box compute
  • Why it matters: Provides concrete architectural patterns for solving privacy and data access challenges in enterprise multi-agent applications.

Key Points

Agent-to-agent interactions unlock massive network effects

  • Explanation: Just as human work relies on collaborating with other people, AI agents working together create exponential network effects and value.
  • Evidence: Real-world work models demonstrate that more is better when agents can collaborate across boundaries.
  • Practical implication: Engineers must build systems that allow agents to seamlessly communicate and share data safely.

The Coase Theorem applied to agent silos

  • Explanation: Even with infinite context windows, privacy and security constraints prevent humans from sharing all context, creating silos.
  • Evidence: Economic principles show transaction costs and privacy concerns limit ideal information sharing.
  • Practical implication: Multi-agent systems must navigate privacy constraints rather than assuming complete data access.

The frontier is automated policy enforcement and auto-mode

  • Explanation: As models and safety policies improve, systems will increasingly automate decisions around data sharing and human oversight.
  • Evidence: Coding and approval workflows are moving from strict manual checks to autonomous handling with low-sensitivity zones.
  • Practical implication: Developers should define low-sensitivity zones and trust boundaries to allow systems to scale autonomously over time.

Frameworks, Models & Processes

Five Strategies to Get LLMs the Right Data

  • How it works: A spectrum of approaches ranging from broad access approximations to automated black-box compute with human approval.
  • Components:
    • Approximate access to everything within trust boundaries
    • Privacy-preserving cross-silo tools
    • Create shared silos
    • Humans as the conduit
    • Black-box compute with approval on inputs
  • When to use: When designing enterprise AI agent architectures and determining data governance policies.

Examples & Case Studies

A tool checks everyone's Gmail across a company and returns a relationship strength score without exposing raw conversation content.

  • Illustrates: Privacy-preserving cross-silo tooling (signal, not content).
  • Lesson: You can enable agentic discovery across company silos while preserving user privacy by returning computed metrics instead of raw text.

Actionable Takeaways

  • Immediate:
    • Evaluate whether your agent architecture relies on manual data silos or automated discovery.
    • Design tools that separate signal from content to preserve privacy.
  • Strategic:
    • Anticipate a shift toward automated ('auto-mode') policy enforcement in multi-agent systems.
    • Recognize that multi-agent network effects will drive the next wave of AI utility.
  • Questions to investigate:
    • How do we prevent prompt injection across siloed agent networks?
    • Can we trust autonomous agents to make privacy disclosure decisions correctly?

Claims Worth Verifying

  • Running an LLM agent is fundamentally a search problem focused on context window optimization. (conceptual)
  • Black-box compute architectures with automated input verification can eliminate the need for manual human-in-the-loop conduits. (architectural)

Notable Quotes

"I don't think agent to agent makes much sense as a concept. So I want to reframe the entire talk in terms of search." (at 1:52) "If this is only strategy, you lose over the next 3 years." (at 7:02)

Compressed Summary

  • Agents can be framed as search problems over context windows.
  • Multi-agent systems face data silo and privacy challenges modeled by economic theory.
  • Five strategies exist for data access: trust boundaries, cross-silo tools, shared silos, human conduits, and black-box compute.
  • The future trend is moving toward autonomous ('auto-mode') policy enforcement with human review.
  • Keywords: agents, search, privacy, silos, network-effects
  • Core insight: Multi-agent systems unlock massive network effects, but scaling them requires sophisticated privacy-preserving cross-silo tools and automated policy enforcement rather than naive shared context.

Core insights

5
Mental Modelhigh noveltymoderate evidence

LLM agent execution is fundamentally a search problem: the core task is ensuring the context window contains the right information at the right moment before a tool call or user response, not just composing a better prompt.

Why it matters

It moves the engineer's focus from prompt authoring to building retrieval/indexing and context-population mechanisms. Most agent infrastructure investment should therefore target context acquisition and relevance rather than model prompting.

Generalization

Any agentic system can be analyzed as a search system whose corpus is the union of tools, memories, databases, and other agents' outputs; agent quality reduces to context-placement quality.

I don't think agent to agent makes much sense as a concept. So I want to reframe the entire talk in terms of search.
Open source video
Running an LLM agent is fundamentally a search problem focused on context window optimization.
Open source video
Mechanismhigh noveltystrong evidence

Privacy-preserving cross-silo tools can enable agentic discovery without exposing raw content by returning computed signals (e.g., relationship strength across company Gmail) instead of the underlying messages.

Why it matters

This gives system builders a concrete tool-design pattern for working across data silos while respecting privacy: export signal, not content. It blurs the line between data access and computation inside tools.

Generalization

For multi-agent or multi-tenant systems, tool APIs can expose derived metrics or policy-scored results rather than raw rows or documents, enabling network effects without centralized data sharing.

A tool checks everyone's Gmail across a company and returns a relationship strength score without exposing raw conversation content.
Open source video
Privacy-preserving cross-silo tools trade off power and privacy.
Open source video
Architecturehigh noveltymoderate evidence

The common enterprise strategy of approximating 'access to everything' within a trust boundary is an architectural dead end: it is popular with IT and security teams but fails to scale or break down silos.

Why it matters

Engineers should not centralize or broadly mirror data inside a trust boundary as the default multi-agent data strategy. Instead, systems need a spectrum of mechanisms: cross-silo tools, shared silos, human conduits, and black-box compute.

Generalization

Trust boundaries should be treated as first-class architectural seams, with different data-flow patterns across boundaries depending on data sensitivity, not as monolithic zones where all data is accessible.

Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.
Open source video
Five strategies used by companies to get the right data into LLM context windows within trust boundaries.
Open source video
Mental Modelmedium noveltymoderate evidence

Applying the Coase theorem to agent silos: even if context windows become effectively infinite, privacy and security constraints create transaction costs that prevent total context sharing, so agents will always operate within imperfect, partitioned information boundaries.

Why it matters

Multi-agent architectures cannot assume a future where all relevant context is available to all agents. Design must optimize under constraints of incomplete context, negotiated disclosure, and trust boundaries.

Generalization

In any sufficiently large multi-actor system (human or agent), costs of sharing all context are prohibitive; information systems need mechanisms to operate on partial visibility and to create value across silos through structured exchanges.

Even with infinite context windows, privacy and security constraints prevent humans from sharing all context, creating silos.
Open source video
Economic principles show transaction costs and privacy concerns limit ideal information sharing.
Open source video
Predictionmedium noveltymoderate evidence

The next frontier for enterprise multi-agent systems is automated policy enforcement and 'auto-mode': moving from strict manual human-in-the-loop approvals to autonomous handling for well-defined low-sensitivity zones.

Why it matters

Engineers should design permission and approval systems that can graduate from manual oversight to automated policy enforcement as model safety and policy quality improve. Low-sensitivity zones become the scalable substrate for agent autonomy.

Generalization

Workflow systems that embed human approvals today should model those approvals as policy decisions that can be progressively automated, while preserving audit and override paths.

The frontier is automated policy enforcement and auto-mode.
Open source video
Developers should define low-sensitivity zones and trust boundaries to allow systems to scale autonomously over time.
Open source video

Deep dives

4

Cross-silo tools that return computed signals instead of raw content: a privacy-preserving design pattern for agent APIs

Research question

In which contexts can a computed signal such as a relationship-strength score preserve agent task utility while protecting the underlying raw data, and what reconstruction or inference risks remain?

Why

Agent-to-agent network effects depend on sharing value across trust boundaries, yet raw content exposure blocks cross-silo collaboration in real deployments. Understanding the power-privacy tradeoff of signal-output tools is necessary to make privacy-preserving multi-agent ecosystems practical.

A tool checks everyone's Gmail across a company and returns a relationship strength score without exposing raw conversation content.
Open source video
Privacy-preserving cross-silo tools trade off power and privacy.
Open source video
Source video

Agent execution as a search problem: quantifying the impact of context-population choices on agent performance

Research question

How much of agent task success is explained by the retrieval/indexing/context-placement strategy rather than by prompt quality or model choice?

Why

If agents are fundamentally search problems over context windows, teams should allocate substantive engineering investment to the context-serving infrastructure instead of iterating on prompts. A causal measure of that shift is critical for agent platforms.

Running an LLM agent is fundamentally a search problem focused on context window optimization.
Open source video
Most LLM systems are fundamentally search problems.
Open source video
Source video

Sensitivity-zone classification as the foundation for automated policy enforcement in production agents

Research question

How should low-sensitivity zones be defined, learned, and audited so that autonomous policy enforcement in 'auto-mode' scales without increasing privacy violations?

Why

The stated frontier for enterprise agents is moving from manual human-in-the-loop approvals to automated policy enforcement. Without a principled way to detect low-sensitivity zones and escalate edge cases, auto-mode will either be too brittle or unsafe.

The frontier is automated policy enforcement and auto-mode.
Open source video
Developers should define low-sensitivity zones and trust boundaries to allow systems to scale autonomously over time.
Open source video
Source video

A decision framework for composing the five agent data-access strategies across trust boundaries

Research question

What observable factors (data sensitivity, silo relationship, task type, policy cost) should route an agent request to broad trust-boundary access, cross-silo tools, shared silos, human conduits, or black-box compute?

Why

The talks list multiple strategies but no way to choose among them. Multi-agent platforms need a normative composition framework so that engineers are not optimizing for a single data regime.

Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.
Open source video
Five strategies used by companies to get the right data into LLM context windows within trust boundaries.
Open source video
Source video

Article ideas

4

Your Agent Is a Search Engine: Stop Prompting, Start Placing Context

The highest-leverage engineering in production agent systems is retrieval, indexing, and context placement; prompt authorship is the tail end of optimization.

Angle

Technical essay reframing an agent loop as a context-window search problem, with implications for where teams should put their infrastructure budget.

Source video

Bigger Context Windows Will Not Kill Data Silos

Privacy and security transaction costs will keep information partitioned even if context windows become effectively infinite, so architecture must assume partial visibility and design negotiated disclosure mechanisms.

Angle

Provocation applying the Coase theorem to agent silos to redirect AI products from maximizing context volume to structuring constrained exchange.

Source video

Return the Signal, Not the Silos: A Design Pattern for Privacy-Preserving Agent Tools

To get network effects across data silos, agent tools should return derived signals such as relationship scores or policy-scored answers instead of exporting raw content, deliberately trading power for privacy.

Angle

Pattern guide showing how a Gmail cross-silo relationship tool becomes a template for building cross-boundary agent APIs.

Source video

The Real Agent Frontier Is Auto-Mode and Policy Enforcement

Agent autonomy will not scale by improving model reasoning alone; it will be unlocked by sensitivity classification, automated policy enforcement, and trust boundaries that define which zones are safe to run without human oversight.

Angle

Argument that developers should design permission systems as progressively automatable policy decisions rather than static human gates.

Source video

Project ideas

3

Context Placement Harness

beyond-evals

For a fixed agent task, improving context placement and retrieval tooling yields at least a 30% relative task-success improvement equal to or greater than spending the same engineering budget on prompt engineering.

Proof of concept

Build a benchmark around a tool-using agent, comparing variants with (a) sophisticated retrieval/index/context selectors and (b) prompt refinements; keep the underlying model constant and track expected engineering hours.

Measurement

Task success rate, context-window fill efficiency, and latency/cost per engineering-hour invested.

Source video

Signal-Score Cross-Silo API

gatehouse

An agent using a relationship-strength score API can answer referral/interaction questions within 5 percentage points of an agent with raw corporate email access, while exposing zero raw email content to the model.

Proof of concept

Create a synthetic email corpus and a cross-silo tool that computes a relationship score per pair; run two agents side-by-side: one with the signal API and one with raw corpus search.

Measurement

Task accuracy, number/size of raw content leaks sent to the model, and user trust/explanation quality.

Source video

Sensitivity-Zone Auto-Approval Engine

new

A policy engine that automatically classifies agent actions into low-sensitivity/low-risk zones can reduce manual approval load by at least 80% without increasing policy-violation rate beyond an allowed audit threshold.

Proof of concept

Instrument a development-workflow agent to request permission gates; train/use a classifier on action metadata and PII/data-sensitivity indicators; run in shadow mode against human approvals for N=2,000 actions.

Measurement

Manual review reduction, false-approval/violation rate, escalation rate in higher-sensitivity zones.

Source video

Architectural implications

5

Agents are 'search problems over context windows'.

Before

Agent engineering centered on prompt construction, model choice, and chain-of-thought design.

After

Agent engineering centers on retrieval systems, index design, context selectors, and tool schemas that populate the context window at the right time.

Consequence

The core high-leverage artifacts in an agent codebase shift from prompt text to context-serving infrastructure.

Source video

Inter-agent privacy is handled by cross-silo tools that return signal-derived outputs rather than raw content.

Before

Inter-system data sharing meant exporting or duplicating data across a trust boundary.

After

Tools perform computation over data and return aggregated, scored, or filtered outputs that preserve the utility of the data without exposing it.

Consequence

Tool design becomes not just an interface to a data source but an enforcement point for privacy policies and an abstraction over the underlying personal/corporate data.

Source video

No single data-access strategy (trust boundaries, cross-silo tools, shared silos, human conduits, black-box compute) is sufficient.

Before

Enterprises commonly standardize on one access mode: 'give the agent access to everything within the org boundary.'

After

Architectures compose multiple access strategies matched to data sensitivity and silo relationships.

Consequence

Platforms must support heterogeneous boundary-crossing mechanisms, from shared wikis to black-box compute, rather than a single universal access layer.

Source video

Even with infinite context windows, silos remain because privacy/security costs limit sharing.

Before

The long-term answer to silos was assumed to be larger context windows and more permissive access.

After

Systems should be designed to make good decisions with incomplete context and to cross boundaries through constrained, policy-aware exchanges.

Consequence

Product and protocol design should focus on exchange mechanisms and incentive structures, not on maximizing context volume.

Source video

Human-in-the-loop approvals are giving way to automated policy enforcement in low-sensitivity zones.

Before

Approvals were a static gate: a human must check every high-risk action.

After

Systems define low-sensitivity zones where policy enforcement is automated, with humans reserved for escalating cases in higher-sensitivity zones.

Consequence

Policy engines, sensitivity classification, and automated verification become core components of production agent platforms.

Source video

Tradeoffs and failure modes

4

Power vs privacy in cross-silo tools

Benefit

Enables agentic discovery across silos while protecting raw content by returning signals (e.g., relationship strength).

Cost or risk

The computed signal is lossy or intentionally biased; agents may miss information or be unable to explain exactly why a score was returned.

Privacy-preserving cross-silo tools trade off power and privacy.
Open source video
Source video

Broad access within trust boundaries

Benefit

Simple and popular for IT/security teams; gives agents maximal data in context.

Cost or risk

Fails to scale and fails to break down silos; agents can't reach data outside the boundary, and centralization becomes brittle.

Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.
Open source video
Source video

Humans as the conduit between silos

Benefit

Preserves trust and handles ambiguous privacy decisions through human judgment.

Cost or risk

If this is the only strategy, it will not keep pace with the needed scale of agent-to-agent interactions.

If this is only strategy, you lose over the next 3 years.
Open source video
Source video

Automated policy enforcement vs adversarial manipulation

Benefit

Enables autonomy, lower latency, and scaling to many low-sensitivity zones without human review.

Cost or risk

Autonomous agents given disclosure authority may be attacked via prompt injection or make privacy mistakes when policies are ambiguous.

The frontier is automated policy enforcement and auto-mode.
Open source video
Source video

Open questions

4

How do we prevent prompt injection across siloed agent networks?

Why unresolved

When agents can execute searches and invoke tools across trust boundaries, their inputs contain untrusted data that can carry malicious instructions.

Research direction

Develop provenance-aware context handling, tool-level sanitization, and output-classification methods that prevent injected content from changing agent behavior.

Source video

Can we trust autonomous agents to make privacy disclosure decisions correctly?

Why unresolved

Privacy decisions are subtle, context-dependent, and high-stakes, and the summary indicates policies may become automated over time.

Research direction

Benchmark agent privacy decision-making against human judgment, and build confidence-scoring or audit systems for automated privacy decisions.

Source video

How should sensitivity zones be defined and learned so that auto-mode can scale without over- or under-restricting agent actions?

Why unresolved

The summary argues low-sensitivity zones enable autonomy, but gives no mechanism for classifying zones dynamically.

Research direction

Prototype policy engines that classify transactions and data by sensitivity and adjust approval requirements based on risk estimates.

Source video

What is the right architecture for combining the five data-access strategies in one production agent system?

Why unresolved

The summary lists the strategies but does not provide a decision framework for when to use each strategy.

Research direction

Develop a decision matrix based on data type, trust relationship, and agent task; measure impact on privacy-preserving agent capability.

Source video

Key claims

7
opinionVerification not requested

Most LLM systems are fundamentally search problems.

Evidence

Most LLM systems are fundamentally search problems.

Source video
opinionVerification not requested

Running an LLM agent is fundamentally a search problem focused on context window optimization.

Evidence

Running an LLM agent is fundamentally a search problem focused on context window optimization.

Source video
factualVerification needed

A privacy-preserving cross-silo tool can return a relationship strength score from everyone's Gmail without exposing raw conversation content.

Evidence

A tool checks everyone's Gmail across a company and returns a relationship strength score without exposing raw conversation content.

Question

Does this tool preserve useful relationship signals while preventing an agent from reconstructing the underlying messages?

Source video
causalVerification needed

Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.

Evidence

Approximating access to everything within trust boundaries is popular for IT and security teams but fails to scale or de-silo.

Question

What specific failure modes or scale limits were observed in practice to support this claim?

Source video
predictionVerification needed

Even with infinite context windows, privacy and security constraints prevent humans from sharing all context, creating silos.

Evidence

Even with infinite context windows, privacy and security constraints prevent humans from sharing all context, creating silos.

Question

Will new privacy-enhancing technologies change this economic tradeoff and reduce the need for silos?

Source video
predictionVerification needed

Black-box compute architectures with automated input verification can eliminate the need for manual human-in-the-loop conduits.

Evidence

Black-box compute architectures with automated input verification can eliminate the need for manual human-in-the-loop conduits.

Question

Can automated input verification cover the full range of privacy-sensitive decisions that humans currently review?

Source video
opinionVerification needed

Developer workflow approvals are moving from strict manual checks to autonomous handling with low-sensitivity zones.

Evidence

Coding and approval workflows are moving from strict manual checks to autonomous handling with low-sensitivity zones.

Question

What evidence from production coding workflows demonstrates this shift, and how reliable is it?

Source video

Connections

5