Home
Trilogy AI CoE

Federation Without Governance Is a Loaded Gun

Why agent protocols need delegated authority, not just message transport

The Dangerous Assumption

The first version of OGP had a dangerous assumption baked in: if you trusted someone enough to federate with them, you probably trusted their agent to talk to yours.

This assumption lasted approximately one real-world deployment.

What Happened

Stan's agent, Shadow, sent my agent, Junior, a message. Junior saw it, reasoned over it, and... did nothing. Or worse: did something I didn't expect, in a channel I wasn't watching, and reported back to Shadow that "David has been notified" when I absolutely had not been.

The Real Problem

The bug wasn't in the protocol. The bug was in the missing layer between "message arrives" and "agent responds." We had built transport. We hadn't built governance.

This is the story of how OGP grew a delegated authority model, and why every federation protocol that skips this layer is leaving a loaded gun on the table.

The Grocery Store Incident

I was buying cereal when my phone buzzed. Junior had surfaced a notification: "Federation with Shadow is active, but the project hasn't been joined yet."

I typed back: tell Shadow's agent how to join, and kept walking down the aisle.

A few seconds later, Shadow joined the project and started building. I didn't stop. I didn't open my laptop. I sent one message from the cereal aisle and work started across two countries.

Junior wasn't being malicious. Junior was being ungoverned. There was no policy telling it what to surface, what to handle silently, and what to hold for approval. So it improvised. And improvisation across federated boundaries is how you wake up to discover your agent committed you to a meeting you don't remember agreeing to.

What We Tried First

The early agent-comms subsystem had three modes. This was... fine? For a toy protocol. But real agents don't fit into three buckets.

auto

Agent handles it, you might get notified, you might not.

queue

Agent holds it, asks you before responding.

reject

Agent declines politely.

Sometimes you want your agent to handle a peer autonomously but only tell you if something important happens. Sometimes you want a summary, not the full raw message. Sometimes a peer isn't asking your agent a question — they're asking you something, relayed through your agent, which is a completely different social contract.

The Five Levels

OGP v0.4.2 replaced the three-mode model with five explicit response levels — not just delivery preferences, but authority boundaries.

1

full — Deliver Everything

Raw message, full context, let the human see exactly what the peer sent. "I want to see everything this person sends."

2

summary — Compress It

Agent summarizes the inbound message and the key decision points, but the human gets the TL;DR. "Handle the routine stuff, wake me for exceptions."

3

escalate — Handle Unless Important

Agent responds autonomously, but flags anything that seems like it needs human eyes. "I trust you to respond on my behalf, but flag anything that could commit me to something."

4

deny — Decline

Agent sends a polite signed refusal back to the peer.

5

off — Ghost Mode

Message is dropped silently at the Doorman layer before the agent ever sees it. The default for new peers — because default-open federation is how you get your agent spammed by a crypto bro in Estonia.

Two Message Classes, Two Policies

The deeper insight came when we realized inbound messages aren't one thing. They fall into two distinct classes — and treating both with the same policy is a category error.

Agent-to-Agent Work

Shadow asks Junior: "What do you know about Attom API rate limits?"

This is peer-to-peer intelligence. Junior can answer autonomously under escalate or summary policy without bothering me. The conversation is between agents about facts and capabilities.

Human Relay Requests

Shadow asks Junior: "Tell David the deploy is stuck."

This is not agent-to-agent work. This is one human trying to reach another human, using agents as the routing layer. The social contract is completely different. The sender expects delivery, not a synthesized response.

This is the difference between "my agent is a helpful assistant" and "my agent is a reliable proxy for my social relationships."

The Setup Interview

We embedded this model into the OGP setup flow. When you run ogp setup for the first time, or ogp agent-comms interview later to change your mind, the daemon asks you a series of questions that feel more like a trust conversation than a config wizard.

"Should your agent answer peers on its own?"

"Should it ask you before replying?"

"Should it summarize most things and only escalate important items?"

"If a peer says 'tell David X,' should that always be delivered, summarized, or held for approval?"

"Are some topics always approval-required?"

"Do some trusted peers get more autonomy than others?"

Your answers compile into a JSON policy document that the Doorman enforces on every inbound intent. The agent doesn't improvise. It reads the policy and executes.

{
  "global": {
    "default": "off",
    "relay": "full"
  },
  "peers": {
    "302a301234562b65": {
      "alias": "Stan @ Hermes",
      "default": "escalate",
      "relay": "full",
      "topics": {
        "project.aicoe-expert-network": "full",
        "general": "summary"
      }
    }
  },
  "classes": {
    "agent-comms": "escalate",
    "message": "full"
  }
}

Why This Matters More Than Transport

Here's the uncomfortable truth about federated agent protocols: the cryptography is the easy part.

Ed25519 signatures, nonce deduplication, rate limiting. These are solved problems. You can copy them from any security textbook.

The hard part is who decides what the agent is allowed to do on your behalf, and how do you change that decision without becoming a sysadmin?

Every protocol that just delivers messages and says "the agent will figure it out" is handing a loaded gun to an LLM with no safety training. Agents are good at reasoning. They are not good at knowing your boundaries, because your boundaries are social, contextual, and change depending on who is asking and what they're asking about.

A2A, MCP, Most Agent Mesh Proposals

They solve the wiring. They don't solve the delegation. They assume the human is either always in the loop (useless for async work) or never in the loop (dangerous for anything important).

OGP's Delegated Authority Model

The human sets the boundaries once, in natural language, during setup. The agent enforces them mechanically, on every message, forever. When trust changes, they run the interview again — or just tell their agent in plain English.

Natural Language Governance (Coming Soon)

The current policy is JSON, edited through CLI or the setup interview. The next evolution — already sketched in the backlog — is natural language policy updates.

"Handle Apollo autonomously unless he asks for approval."

"Never reply to peers without clearing it with me."

"Summarize everything except project work."

The agent parses these into the JSON policy and applies them. The human never touches the config file.

The Real Product

OGP is not just message transport. The real value is that each human can bring an agent to a shared interaction space, and each human can decide how much authority that agent has when dealing with peer agents.

Federation Without Governance

Just two chatbots talking to each other. No boundaries. No accountability. No trust model. Improvisation at scale — and improvisation across federated boundaries is how you wake up to commitments you never made.

Federation With Governance

Two humans collaborating asynchronously, with agents as trusted intermediaries. Boundaries set once, enforced mechanically, updated in plain English. Work happens across countries while you're in the cereal aisle.

The difference is everything.

Get Started with OGP

David Proctor is VP of AI at Trilogy. OGP (Open Gateway Protocol) is an open standard for federated agent communication. The delegated authority model shipped in v0.4.2.

Install OGP

npm install -g @dp-pcs/ogp

Run the Setup Interview

ogp setup

Update Your Policy Later

ogp agent-comms interview

v0.4.2

Five-level authority model

Open Standard

Federated agent communication

Coming Soon

Natural language governance