Through a central layer, for anything that can change a record, reach a customer or move money. A central layer checks the receiving agent's bounds, keeps the sender's identity and the facts' sources attached, stops loops and files every handoff. Direct agent-to-agent calls are acceptable only for low-risk, read-only exchanges, and even then they cost you the record.
What goes wrong when agents talk directly?
Direct connections are simple to build: agent A calls agent B's endpoint with a request. For a few agents, it works. As the number grows, problems accumulate.
No common check. Each receiving agent decides for itself whether to act on a request. Some check carefully; some do not check at all.
Identity gets lost. Agent B knows the request came from agent A's address. It may not know which certificate A held, on whose behalf it was acting, or whether A was itself relaying a request from elsewhere.
Facts lose their labels. A's summary of a customer's email reaches B as plain text. That it started as an external claim is no longer visible.
Records split. Each agent logs its own side, in its own format. Reconstructing a chain means joining logs by hand.
Loops go unseen. Neither agent sees the whole chain, so neither notices when work circles back.
What does a central layer add?
| Concern | Direct | Through a central layer |
|---|---|---|
| Is the receiver allowed to act on this? | Receiver decides alone | Checked against its bounds by the layer |
| Who really asked? | Caller's address | Caller's identity, certificate and lineage |
| Where did the facts come from? | Often lost | Provenance carried with each fact |
| Can the exchange be reconstructed? | Partly, from separate logs | Yes, from one record |
| Are loops caught? | Rarely | Hop and return limits applied |
| Can a person step in? | Only if each agent built that in | Holds route to a named person's queue |
The last row matters in practice. A central layer gives every held item a single place to land, so people work one queue rather than checking each agent; see how to work through an AI agent's held queue each day. The broader argument is in human gates belong in the platform, not in each workflow.
What does the central layer cost?
Latency, a little: each handoff adds a check. Availability, more: if the layer is down, agents stop handing work to each other. That should be designed for, with the layer running as reliably as the systems behind it, and failing closed so nothing proceeds unchecked.
There is also a design cost. Every agent needs its own identity and every handoff a defined format. How agents identify themselves is covered in how AI agents authenticate to other systems.
Is a central layer the same as an orchestrator?
No. An orchestration layer decides which agent does what and in which order. The central governing layer decides whether each step may happen, regardless of who routed it. They often sit side by side; the difference is set out in how an agentic operating system differs from an orchestration layer.
What does this look like in practice?
Take a bank where a customer-service agent needs a card blocked after a customer reports it stolen. Directly, it could call the card agent's endpoint with "block card ending 1234". The card agent might act without knowing that the request originated from a phone call the service agent has not yet authenticated.
Through the central layer, the request carries the service agent's identity and the fact that the customer passed authentication in the logged-in app, stamped with its source. The card agent's bounds allow blocks at depth 3 when the customer is authenticated. Blocked, and filed. If the same request had come from an unauthenticated email, the layer would have held it. Blocking is easy to reverse, so the bank also allows a temporary block on weaker evidence, with a person confirming within a set time. Unblocking is stricter.
When are direct links acceptable?
For read-only exchanges of non-sensitive reference data between agents inside the same trust boundary, where nothing is decided on the answer. Even then, consider routing through the layer for the record alone. The governing design is in the governed agentic operating system guide.
Questions people ask
Does a central layer create a single point of failure?
It creates a single point of control, which must be built for availability like any critical system. Failing closed means an outage delays work rather than letting it proceed unchecked.
Can agents still use open agent-to-agent protocols?
Yes. The protocol defines the message; the central layer receives it, checks it and passes it on. The two work together.
What about agents from outside our business?
All the more reason for a central layer. Requests from outside agents arrive as external claims and must be checked against your agents' bounds before anything happens.