Agents' next frontier: agent-to-agent and network effects — Jean-Denis Greze, Town

Agents that work with other agents

00:12hear me? All right. Um, well, first, thanks for coming. I can't believe there's anybody in the room, but that's very nice. Uh, uh, my name is Jean Deni. Um, I'm CTO at a company called Town. We're not gonna really talk about town. So you can go to town.com and check that out if you want, but that's not the point of the talk today.

00:26I was CTO at Plaid for seven years and then I was a Dropbox before and then before that I built software for hedge funds. I've done lots of stuff in my career and right now I'm working on uh assistance agents for for normal people, not not for engineers, but for like basically everyone in America, in the world.

00:44And one of the things we've been working on are systems where agents work with other agents. So agent to agent. And the main idea is that we think there's huge network effects if agents can work together to get things done for people because in the real world the way most of us do work is with other people, right?

01:09Uh more is better. But actually I don't think agent to agent makes much sense as a concept. So I want to reframe the entire talk in terms of search. So I I think most LLM systems are just a search problem. And what you're trying

Multi agent systems reframed as a search problem

01:26to do is you're trying to make sure the context window right before you either return results to the user or before a tool call, you're trying to make sure the context window has the right information for the user. If you put the right information in the context window, then based on the intelligence, so to speak, of the LLM, you will get the best result possible.

01:43Um, so you know, four years ago, the way we did that is humans would populate the context window manually. Then a couple years ago, most people were ragging, so they were like, let's have a tool like a search tool that can look across systems and bring the data in there.

01:59And then people were like, well, that doesn't scale super well, has issues. And now we're all about agentic search, which is the idea that you give the agent a lot of tools and it will search through the space of all content. And then hopefully before it makes a tool call, it has exactly the right content to make the right tool call to return the right information to the user.

02:16Um, and in this, by the way, there's no there's no people. It's just the one LLM call at the like the one that matters having the right context. That's that's what you're trying to do. You're trying to engineer that system.

The single agent that could see everything

02:30Cool. So, what does that have to do with agent to agent? So I want you to imagine the following world. There's not many agents that can do things. There's just one agent, right? And it has one context window and it has access to all the information in the universe.

02:47It can look at any one person's email. It can look at any company's information. Can look at any government's information. And it has it right there in the context window. And then you ask it to do something. You you have your little system prompt before all that data.

02:57And what's going to happen is it'll give you the best possible outcome. And that actually that is a multi- aent world. It's just an agent that has access to all the world's information. That's the natural state of things. That's the ideal state of things.

03:11There's a problem with this state of things. And the problem comes from if you study law in economics, something called the coast theorem. And it says that basically even humans if they all have access to all the right

The Coase theorem and the privacy limit

03:26information and there's no transaction cost we get the economically ideal outcome out of a out of a contract or a negotiation. Well, it's the same thing. We can't put all of the world's context. We can't make it available to the LLM like theoretically even with infinite context window because of privacy and security.

03:44We're humans. I don't let you look at my email. So there cannot be an agent that I'm willing to just let it look at my email all the time. But if it existed, it would be very very powerful. So I I think this is like this is the test for a multi- aent system, which is how well does it approximate this?

03:58If it approximates this, that means if you can get the same data in your window that a perfect system that has access to all the world's data could, then you get the optimal outcome. That's what you need to try to do. So we're going to talk about five strategies that people use at various companies to try to get the right data into that that LM call with an externality.

04:15So the first one is

Strategy one, a shared trust boundary

04:25approximate access to everything within a trust boundary. So my wife and I, we have an agent together and that agent has access to my email and her email uh including emails before we were married. Uh and it's okay. She doesn't ask my agent questions about that, but she does ask about, you know, whether I like scheduled something for her kids or, you know, uh, if I followed up on some third party thing.

04:47And so, the fact that our agent has access to both of our systems is wonderful. Um, and the work context, this might be there's a an HR team agent that has access to all the HR systems just like an employee of the HR team would or maybe as much access as the lowest employee in the HR team.

04:55All the employees in the HR team have the ability to ask this agent questions and boom, it gets pretty good results and this is very popular right now. Uh it's very popular with IT teams and security teams because it's the same model as SAS for security.

05:18So it works really well. I think it has a problem which is a fundamental problem that if I wake up in the morning it's like basically the only thing I think about which is does it get over time does the system naturally require fewer humans and then as the

Why that approach does not scale with the models

05:34models get better does this approach get better and the problem with this approach is the answer is no to both uh you still need humans to think about all the data and you don't get magical desiloification of your data you've just created a new silo because a human thought about it so the problem with this I do think if this is your approach to building better AI, you're going to be in the next couple years.

05:49Um, but that's okay. You're is my opportunity. Uh, I'm just I'm just not an I'm sorry. That was mean. But like I think it's not I think it's a good now way to think about it. It's not the good endgame way to think about it. The other approach which I think is a little more clever and I'm going to try to explain it is basically you try to have tools that make a different trade-off between power and privacy.

06:15So I'm going to give you an example here. U the use case is I want to ask my agent

Strategy two, tools that trade power for privacy

06:23does anyone in my company is anyone in my company connected to someone on the finance team at Acme Corp. And so my the no silo way to do that is just give me access to everyone's Gmail in my company. I'll see who has emails with people from Acme Corp.

06:31Then I'll look at their profile on Google or LinkedIn and then I'll be like, "Oh, you seem to email a lot with the CFO. Can you do the intro for me?" But right obviously silos, we don't want that. So what if you built a tool and what the tool did is it looked at everyone's Gmail.

06:48So that tool had access to everyone's Gmail and it just returned a relationship string score. So the tool you would give it like a domain and you would say I'm looking for someone who's a CFO. It would look at everyone at the company who sent emails to that company and then it would like rank their score and they would give you back the score and then the agent would get the score and it would be like cool.

07:05Then it would use a Slack tool to text that person at the company like hey Bob I see that you're connected with Jane who's the CFO at Acme Corp and then Bob would be like yes I am and then your AI would be like oh can you draft an can I draft an email or can you draft an email introducing me and then Bob would say yes and he would do that and you'd be connected and everything would be wonderful.

07:28So this is actually very cool approach. I don't know how many of you do it. Like we we do this at town for a few things that we see a lot of our users do. We ask oursel what is a privacy preserving tool that all of our users would be okay existing.

07:42They can opt out if they don't want it but it has a natural network effect because it breaks through silos in an interesting way. Um like another one that's interesting here is letting other people put draft emails in your inbox. You let other people at your company draft emails on your behalf because they're going to ask you to anyway to get intros if they're on the sales team.

07:59So, might as well save yourself a few clicks. So, the question here is like, are people going to be okay with a privacy trade-off that you make within a corporation? Ah, bad, bad. Oh, boy. Within a corporation that will, you know, mostly it works.

08:12Um, so the problem here again is it's again manual and not dynamic. It's manual because humans need to think about the tools. Maybe AI could build the tools. Uh, and it's also manual because you need to explain it to everyone that it's happening.

08:23Humans may not like it if this is happening and they're not okay with the privacy security, the privacy kind of power trade-off that you've made. Cool. And again, this doesn't really get better as the AI gets better,

Strategy three, shared silos and the sweeper agent

08:39which is a problem. Cool. So now the third category, this one's super popular, but only mostly in the single user context. So this is, you know, like personal wiks in claw land. That's what we would call it, but it's across teams. So it's a shared silo.

08:51create a new place where data accumulates within your company, within subgroups of your company. Um, and you start to put more and more stuff there over time and all the agents have access to that stuff. Because they have access to it, you no longer have information that would be okay to be shared that's stuck in a silo.

09:05It now automatically filters out into this public space. So, examples, shared skills. If you code in an organization, probably in your repo, you have shared skills. Anyone can make them better. someone has a better way to you know profile your database or whatever they can write the skill next time someone sitting there is like oh my god the database query is slow it uses the profiling skill and everyone's a better engineer so that's one version the other one that's pretty popular is people

09:36decide they have some shared mediums like a wiki air table etc and they uh they have a skill that says hey put more data in there over time so these are cool um and they work as long as your your agents have those tools and also some trajectory incentives to really like get data out in and out of of these shared silos.

09:52Um I think the next version of this that a few people are working on is like you have a sweeper AI. So this actually if there's one good idea in this talk that I think works really well is this. It's a sweeper AI. So you have an AI inside each private silo.

10:09An AI has a policy about what has to stay in the silo and then it also has a description of all the shared spaces that you have and at the end of the day it looks at new information in the silo and it puts it in the public spaces well public to your company.

10:27So this is the same as the personal wiki that you all have AI building for you at the end of the day so that like it knows your goals and your friends and all that stuff but that's at the company level. Um the hard part is how do we pick what private information is okay to to share and to put in these shared silos.

10:43And I think there's two approaches. There's a ask a human approach. So this is like the LLM comes up with a list of things to contribute and then it asks the user, hey, are you okay with me putting this in the shared space? And you read it.

10:57You're like, yeah, saved you a bunch of time, right? I mean, you weren't going to do it otherwise. Uh I think the other version is you actually ask the LLM to enforce a policy and I think that actually is where things are going to go very very quickly.

11:06Um and I think in the next six months we'll have a bunch of systems where companies have trusted an LLM with a policy to automatically surface more and more information that otherwise would have been private into a public space. If you're like at a Fortune 500 enterprise company, unfortunately I don't think that's going to happen for a while.

11:22But I think if you look at smaller companies like 10 50 person employees, high trust like low likelihood of something one doing bad with the data where it's really clear to know what data couldn't be shared. Basically finance and HR data. You're going to see uh a ton of this and the cool thing here is this really improves trajectories of systems on on common work.

11:47All right, that was third approach. Fourth approach pretty obvious. Use humans as the conduit for information. So this is like traditional agent to agent. My agent ask your agent. Hey, who is connected to someone at the finance team at Acme Corp?

Strategy four, humans as the conduit

12:03You as a human see the request and you're like, "Yeah, I'm okay with that. Go and find the information inside of my email." And then it shows you the result and then you're like, "Yes, I'm okay with that result going to the person who asked."

12:16The big problem with it is for for any request that has low where it's like only a few people will have the information, you're kind of spamming everyone the request. So if I ask this question 100% person company 100 people are being pinged on Slack being like approved on these requests to like farm your personal network for this for this you know h for this like the answer to this question that's not very efficient um so that's why there's a better version of it um which this is this is very powerful but uh I haven't seen it

12:47in practice much it's it's a blackbox approach I wish I had a diagram for this unfortunately for you all I do not so

Strategy five, the black box

12:54Here's what this means. The blackbox approach is where when you ask a question that can only be answered by looking at information in other people's silos. You have an LLM the trace of which no one has access to that gets access to all the data and it gets to the answer.

13:13Right? Like by say get to the answer, it either gets the answer or it's about to do the the the any tool call. That's a right. And then it looks at what information did it need to make that tool call and it only asks the people who own that information for their approval to do the tool call.

13:28So in the example before that I gave when I ask a 100 people at my company, hey do you know the CFO at Acme Corp, the request goes to everyone's agents in my company. All of their agents look in their Gmail and their private silos to see if they're connected to the CFO.

13:41That happens automatically. No, no human is being asked for approval for that to happen. Then it the agent in the blackbox h gets the list of the 20 people who are connected. It looks at context from the emails to determine who has the strongest connection.

13:57It determines that it's Bob. And then it just asks Bob, hey, Jean wants you to introduce him to Jane, the CFO at Acme Corp. I know you're well connected to her. am I okay sharing that bit of information with Jean? And you're like, "Yeah, sure."

14:15You click yes, no big deal. The important thing is you have to trust the black box. So, you have to trust that you can break down all the silos for an LLM that has full access and that doesn't ask for permission until there's this sharing moment or this right step.

14:31So, actually within a company, this is not impossible to do. uh and actually your security and compliance team can get okay with it. Um you just have to have you have to be sure that the human in the loop step is correct and you have to be sure that you're not letting other information go through with the last answer.

14:48So you know like the the nightmare scenarios in things like this are things like um um sorry I'm like we have plenty of time. I'm almost done so it's great. Um, the nightmare scenarios with things like this is someone asks a question like, "Are you connected to a recruiter at the other company that you have no business being recruited to as a way for them to find out that you're interviewing somewhere else, right?"

15:14So, you know, there are you can still sometimes with a black box inadvertently get information out that you shouldn't be able to. You have to really think about how you build a great system. So, those are the those are the approaches. I think if I were to bet on one that has immediate ROI that we're

Where it breaks, and a wiki poisoned forever

15:36going to all see in both like open source clawish worlds and then like small companies it's going to be the wiki that's automatically created by AI like the information base that's kept up to date. I think there will be database versions of it wiki versions of it and I think more and more we're going to trust LLMs to make the decision about what's okay to share and what's not.

15:53there are problems. So prompted junction in in the silos can be a real problem obviously. So if you have a silo that has like that's more open and someone can put something bad in there and then that as part of the energetic search you pull it out you know bad things can can happen.

16:12Uh you can have it's very easy to have a shared wiki that just goes like totally off the rails you know like the information in there one piece of information there is incorrect because Ella made a mistake and then it like poisons it forever.

16:20I have a personal wiki that thinks my agent's name is Apex right now but I renamed my agent a month ago to Ivy and like somewhere in memory bank of uh of my like setup uh Apex lives and so I can't get rid of it. Uh that's fine for Apex. It's a funny one, but it's like much more difficult if it's a really wrong piece of information about your business.

16:44Um, if you don't have human in the loop for any of the steps, obviously there'll be false positives and wrong disclosures. You know, sometimes when there's a wrong disclosure of information, someone gets fired. Someone there's a wrong disclosure, it doesn't matter at all.

17:00Sometimes a customer sues you. So, you know, uh, you got to be careful. Um, and then I think this all sounds nice, but like who approves what, what's logged, what's reversible. The blackbox ID is really great, but it can't truly be a black box.

17:09Someone at your company will want to audit it at some point. They want to understand what's going in there, right? So, at some level, there must be some person in the CESO suite or somewhere that has access to all the data. Um, yeah. So, um, what do I think?

17:25Well, I do think the frontier is auto. So, I've

Auto mode for privacy, and crossing company lines

17:34said that. I think in coding we used to approve everything then we were like yolo live dangerously and now the gods at entropic have granted us auto mode and auto mode tries to figure out when we're maybe being a little silly and it tells us well I think a toa across information silos will be the same way I think what's going to happen is we're going to get comfortable with low sensitivity information being pulled out and put into common spaces and then we will have a place that's like human

17:58review or always human approved and then over time what's going to happen is the LLMs will get more powerful We will be better at encoding safe policies within them. We'll be better at designing for the really hard areas, tools that get the privacy trade-off correct and it'll just be more and more auto for building shared silos and even sometimes for deciding whether it involve a human.

18:15So the example that I have is like if I ask for notes from a weekly recurring call with you know a supplier of ours and their finance team maybe the the LM's like oh well in given your role I don't need to ask anyone on those teams for permission I can just share the notes with you it's like it's fine they can it can look at the content they can see what my role is it can decide from a risk perspective I'm okay with that disclosure um and the cool thing about auto by the way is if you

18:46design your systems that way it'll scale with model capacity so My encouragement would be like you need to start if you have agent to agent or or work across silos which I think the better way to think about it definitely define a low sensitivity zone where you're okay with the LLM making a call and get okay with that and then magically as time goes on it'll get bigger and your system will naturally get more powerful which is what you want because you want to be on a beach that's what you want to do that's where I want to be with my kids in Hawaii.

19:11Okay, network effects I have one minute. Uh this is the conclusion. So we talked about five approaches blah blah blah trust boundaries, custom tools, shared silos, humans the loop and this human in the loop blackbox version. Uh I think this stuff is very powerful.

19:28I think the interesting questions a little bit are within companies. I think this will all work very soon. The big question is where how how comfortable are we are we with something like an auto mode around privacy? And I think the really interesting question that I don't have an answer for, but I think whoever does this will be wealthier than I am, is if you can think of scenarios where you can get multiple companies to agree to their information silos having a common agent working across them.

19:54So there's like a company that I won't name in in in in somewhere in the world uh working on like finance stuff where they have a lot of investment banks and actually the investment banks there's a benefit to them sharing private data about private companies for purposes of things like lending and they're starting to look in this direction where they're trusting each other's agents to be able to work across what before would have been private information with agents deciding what can be accessed and not and it's

20:25it's cool it's very cool and I think once you find some use cases across across companies. Uh I think that would be a really good beach head to to you know as a human though I ask myself do I trust a future where agents make all the decisions around privacy?

20:41I don't know about that. I just think it's a it is better or worse the direction things are going and I ju I'm like so good on time. So I'm on time. Thank you for coming. I again uh yeah, thanks for being here and