When agents deal with each other, the object is the connection

What it says#

On 10 August 2026 the AI Safety Institute, in Australia's Department of Industry, Science and Resources, published Risks and Controls for Multi-Agent Systems, 119 pages ¹. Gradient Institute wrote it. The report's agent is a language model in a harness and scaffold, running plan, act and observe; it calls nothing else an agent ².

Three tiers follow, set by the governance floor the agents can assume. Singular governance has one organisation governing all of them; federated, several in a shared environment under agreed rules; open environments, nobody ³.

Cross-boundary irreversibility: a commitment or data sent past the organisational boundary cannot be reversed unilaterally. Putting it right depends on cooperation, a contract or a court, at human or legal speed ⁴.

Semantic divergence follows: status flags, field names, units or deadlines are vocabulary each side reads differently. A field marked authorised or deadline can mean different things, and a schema does not settle it ⁵.

Evaluation splits capability, what an agent can do, from propensity, how likely it is to do it in deployment. The singular tier can simulate counterparties whose design it knows; federated ones are opaque. In open environments they are unbounded, evidence ages, and evaluation falls back on capability ⁶.

What we take from it#

Our reversibility line, that what can be undone may auto-approve and what cannot goes to a named human, meets the case where the counterparty is another organisation's agent. The report supplies the missing half: the boundary falls where a commitment leaves the organisation's unilateral control. The article turns that into a locator: payment, a firm order, acceptance of material commercial terms, protected data sent outward ⁷. We would keep it: those are points on a process diagram, which "high-risk needs a human" never was. Data is why the last one matters: what crosses carries consent, confidentiality and commercial sensitivity that do not return ⁸.

The principal is the party whose authority an agent acts under, and the party its actions come back to ⁹. An inventory that lists agents is half a record, because the risk sits on the connections between them. Our AI system register needs two columns: the counterparties an agent may bind, and the tier each connection runs at. The article makes the same move, proposing a map of agent relationships as the entry point ⁷.

The report's control is to name the actions with serious consequences and put a human stop-point in front: agreeing a purchase, bidding above a set amount. Both agents acknowledge the terms before either commits, and a clearance period precedes settlement ¹⁰. Its triage says the same in control language: low-risk reversible actions run on automated policy, while high-impact, irreversible or external ones go to a person ¹¹.

Semantic divergence belongs in interface reviews. It is not a data-quality defect, and a validator will not catch it: both sides process correct input correctly and still disagree about what was agreed.

Four actions.

1. List the agents that can bind the organisation. Name the principal, the counterparties it may commit and the tier each connection runs at, and re-run the permissions review when that list grows.
2. Put the stop-point where control ends. Mark the point on each flow where reversal stops being unilateral, and place the human check there, not at the start of the task.
3. Agree the terms that carry consequences. Settle in writing with each counterparty what the few decisive fields mean, before the interface is built.
4. Buy back time. Add a clearance window to transactions that machine speed would otherwise close, and test that someone can use it.

Where we would push back#

The report is an analytical framework, not a rule, and it says so ¹². Reading an obligation out of it would be a mistake, and its tiers describe deployments most organisations do not yet run.

The federated tier asks for a great deal: agreed conduct standards, shared identity, dispute and rollback mechanisms ¹³. Two mid-sized firms wiring a procurement agent to a fulfilment agent will not build that. What they can do is narrower: the stop-point, and agreed vocabulary for the terms that move money.

The capability fallback is honest but uncomfortable: told that evidence about behaviour goes stale, an organisation is being told its assurance decays, and no reporting line yet exists for that. The safer reading is architectural: if the business does not need an agent in an open environment, do not put one there.

Related on GRCIDE#

• Governing AI and agents: who decides what, on the reversibility line and the decision rights around it.
• The permissions review that did not happen, on what an agent inherits when nobody reviews it.
• AI system register, the record the two new columns belong in.