Agents that collaborate

When a person joins a company, the first day is not about talent. It's about structure. They get accounts and permissions. They get introduced to the people they'll work with. They learn who to ask when they need something they don't have, and every consequential thing they do from then on happens on the record — documents, tickets, emails, approvals. What makes a company more than a crowd is not intelligence. It's the machinery of delegation: who may do what, who asks whom, what work survives the handoff, what it may cost, and what happens when someone says yes.

AI agents got the talent first. They are now beginning to get the first day.

By mid-2026, agents are genuinely good. METR measures frontier models completing tasks that take skilled humans five-plus hours, with the task horizon doubling every 131 days. In LangChain's convenience survey, 57.3% of 1,340 respondents reported agents in production. Notion says users built more than a million custom agents in a few months; Notion itself runs 2,800 of them and says it has "more agents than employees."

And the category has crossed from solitary assistants into shared work. Town runs routines in the background across email, calendars, documents, and team spaces; its changelog records agent-to-agent task collaboration reaching general availability in May. Dust Pods let humans and agents share conversations, files, and tasks, including agent-to-agent handoffs. Notion Custom Agents wake on schedules and workspace events, work from permissioned company knowledge, and can call deterministic Node/TypeScript Workers as tools. Collaborative background agents are not a hypothetical. They are arriving now, and the companies building them will compete in the same category.

But there is a large difference between demonstrating collaboration and making it dependable enough to become an institution of work. Today's products work best inside one vendor, one workspace, one shared context, or one administrative perimeter. They are much less mature when Alice's agent and Bob's agent are independently owned; when a task crosses a team or company boundary; when the output has to survive as a governed artifact rather than a chat answer; when authority must be granted and revoked without sharing credentials; or when a five-minute request can fan out into a thousand-dollar model bill.

Sarah Guo said it plainly: "Intelligence is not the bottleneck here. Permission is, and so is accountability." There is one more noun to add: economics. An agent that can act but cannot be given a hard budget is not fully delegated. It is merely trusted with an open tab.

This essay is about that next layer: six structural primitives that turn collaborative background agents from a promising product category into a reliable way for organizations to get work done.

The category has arrived. The institution hasn't.

The durable-agent runtime is already rentable. Cloudflare runs every agent as a Durable Object — "stateful micro-servers that can scale to tens of millions" — with its own SQLite database, hibernation, and as of April 2026 its own email address to wake on. Sandboxes snapshot and branch in under 250ms (Morph), pause and resume indefinitely (E2B), and ship git as the agent's filesystem (Freestyle). Temporal raised $300M at $5B selling the durable-execution substrate underneath. Persistence, scheduling, snapshot, restore: infrastructure, not the unanswered product question.

Background agents that wake on events shipped across the market in H1 2026: Cursor Automations, Claude Code routines, Devin Auto-Triage, Microsoft's Autopilots, Google's Gemini Spark, Town Routines, Notion Custom Agents. The always-on shape is becoming ordinary.

Shared work shipped too. Town has team routines, a team activity surface, tasks, and documents an assistant can create during a routine. Dust puts conversations, files, and tasks in one Pod and deliberately makes the whole Pod visible to every member. Those are real collaboration products, not roadmap slides. They also expose the next problem precisely. Sharing one room is not the same thing as coordinating between rooms. Full transparency inside a Pod is useful when everyone belongs in the Pod; it cannot be the permission model for Finance's agent asking Sales' agent for one number, or a vendor's agent returning one deliverable without seeing the client's internal history.

The line from Anthropic's agent teams documentation is still instructive:

"A teammate cannot approve a permission prompt or supply consent on your behalf."

That is a good safety rule. A message between agents should not inherit the sender's ambient authority. But useful work needs more than authority-free messages. It needs explicit requests, grants, commitments, artifacts, budgets, and receipts. The phone lines exist. What remains immature is the institutional meaning of what travels over them.

Why code got there first — and what it actually proves

The popular explanation for why coding agents won is that code is special: it lives in git, a long-running shared artifact that many contributors mutate safely, so agents could join an inherently collaborative medium. The record only partly supports it.

Shared, long-lived, agent-writable artifacts exist outside code. Microsoft purpose-built one in 2024 (Copilot Pages). Notion agents work autonomously across hundreds of pages. Linear makes agents assignable workspace members. Town now ships a collaborative AI document that routines can create automatically. The artifact itself was never sufficient.

What code had was two things.

A verifier. Jason Wei's verifier's law: "The ease of training AI to solve a task is proportional to how verifiable the task is." Tests pass or they don't. The board deck, the vendor negotiation, and the account plan have no compiler.

A permission protocol disguised as tooling. Branch, diff, review, merge is not merely version control. It is governance. It is how a low-trust contributor — a new hire, an outside contractor, an agent — proposes a change to something valuable without holding the keys to it, with a gate at the moment of consequence and attribution stamped on the result. Karpathy's observation that slides have no useful diff is usually quoted as a UI complaint. It is also an authorization complaint: outside code there is rarely a reviewable unit of change precise enough to say yes to.

The lesson is not that durable artifacts do not matter. It is that an artifact becomes an institution only when identity, versions, provenance, permissions, review, and history travel with it. Code got that bundle early. Knowledge work is assembling it now.

This is not an argument to enter through software development. It points the other way. The first product should live where recurring knowledge work already happens: email, calendars, documents, Slack, and systems of record. The thing to borrow from code is not the repository. It is the governed proposal — a durable revision, a named reviewer, a clear permission boundary, and a record of what changed.

The six unfinished primitives

1. Authority that delegates

An agent should hold a scoped, expiring, revocable subset of its owner's permissions. In practice, many still hold either nothing or everything. Gravitee's survey of 900-plus organizations found only 21.9% treat agents as identity-bearing entities at all; 45.6% still run agent-to-agent authentication on shared API keys. The canonical failure already happened: in the Salesloft Drift breach, stolen OAuth tokens belonging to one chat integration let attackers export data from more than 700 companies' Salesforce instances.

Honesty requires saying what shipped. Microsoft's Entra Agent ID gives agents directory identities, human sponsors, and on-behalf-of exchange. AWS shipped a similar shape in AgentCore. Auth0 ships asynchronous authorization. The primitive exists inside vendor perimeters.

What remains immature is delegated authority as a portable, queryable relationship: this agent may exercise this slice of this person's or team's authority, for this purpose, against this resource, until this time. That relationship must survive a process restart, remain visible to everyone involved, and stop working when revoked. Across independently owned agents and organizational boundaries, the grant — not merely the identity — is the hard part.

2. Requests that become commitments

The wire format for agent communication is not the bottleneck. Google's A2A protocol has Linux Foundation governance, a v1.0 specification, signed agent cards, and more than 150 member organizations. OpenAI handoffs, Anthropic mailboxes, Town task collaboration, Dust task assignment, and vendor-specific orchestration all move work between agents.

The next primitive is not another message envelope. It is a work agreement.

A request needs a requester and a responsible owner. It needs a purpose, deliverable, due date, authority envelope, context package, and budget. The recipient must be able to accept, decline, negotiate, delegate, return an artifact, or report a blocker. Acceptance should create an obligation visible to both sides; completion should settle it. Cancellation, expiry, idempotency, and dispute history are part of the object, not conventions buried in prose.

The ordinary human analogue is the Request access button on a document. The owner gets a name and a reason, approves viewer rather than editor, and a scoped grant appears. Microsoft comes close on the administrative side: an Entra agent can file an access-package request that routes to designated approvers. But it requests from an admin-curated catalog inside one tenant. The harder peer form remains immature: Alice's agent asks Bob's agent to perform or authorize a bounded piece of work, Bob's side accepts under Bob's policy, and neither side inherits the other's private context or credentials.

This is where messages acquire institutional meaning. They do not carry ambient authority. They carry typed requests, explicit grants, accepted commitments, and references to durable objects.

3. Artifacts that survive the task

Collaboration cannot terminate in a chat bubble. The output of knowledge work is a brief, model, plan, decision, dataset, presentation, customer record, or policy — an object that other people and agents must find, cite, revise, approve, and reuse after the producing run has disappeared.

The market is moving quickly here. Town Documents let an assistant and human edit the same object, preserve comments, share it, organize it in a content library, and create it automatically from a routine. Dust Pods keep files beside the tasks and conversations that produced them and make those files immediately available to later agents. These products prove the demand and the shape.

The unfinished layer is artifact governance across ownership boundaries. A durable artifact needs a stable identity, immutable revisions, mutable pointers, provenance, citations, an owning subject, permissions, review state, retention, and lineage back to the requests and model actions that produced it. Sharing context should mean selecting artifact revisions and task facts, not silently forwarding a private transcript. An agent handing work to another agent should be able to say: use these three authorized inputs; return a new revision of this object; do not see anything else.

This is the non-code analogue of branch, diff, review, and merge — generalized beyond text files and preserved across teams and companies.

4. A record you can trust

When a person acts with delegated authority, the deal is accountability: the actions are attributable, reviewable, and can be answered for. Guo's line has a second clause people drop — permission is the bottleneck and so is accountability.

Agents today mostly produce telemetry, not testimony. The observability stack is real and consolidating fast — ClickHouse acquired Langfuse, while LangSmith, Braintrust, and AgentOps fill adjacent niches — but debugging traces are mutable, sampleable, truncatable, and shaped for operators. A Stanford-affiliated study of 196,704 real transcripts estimates 78% of AI failures are invisible. The CSA found 53% of organizations have had agents exceed their intended permissions.

The argument is functional, not merely regulatory: the record is what makes delegation safe to expand. Every request, grant, budget reservation, message, model call, side effect, and artifact revision should append to a tamper-evident record attributable to an agent and through it to an accountable owner. Durable-execution journals prove the mechanics are tractable. What remains immature is making the record a user-facing trust object rather than internal exhaust.

5. Events that cross owners and organizations

Every vendor taught its own agents to wake up. The harder problem is letting independently owned agents wake each other without turning the event bus into a data leak.

Intra-product triggers are table stakes: schedules, new email, calendar events, changed documents, Slack messages, webhooks. Cross-vendor, A2A push notifications report task status inside an existing relationship. That is useful, but narrower than notify my account agent when the client's approved forecast changes or wake the vendor's agent when this redacted brief is ready for its next step.

A subscription is a standing, revocable grant: this principal may learn that this event happened, perhaps with these selected fields, until this date. A wake is an attributable message under that grant. At an organizational boundary, both sides need local sponsors, policy checks, bilateral revocation, rate limits, and explicit shared objects. The organization should remain a security boundary without becoming a collaboration cliff.

6. Budgets that travel with the work

Multi-agent systems do not merely add coordination risk. They multiply spend. Anthropic reports that agents use roughly four times the tokens of chat and multi-agent systems use about fifteen times as many. Anthropic's conclusion is appropriately blunt: the task must be valuable enough to pay for the added performance.

Financial controls have moved well beyond simple provider alerts. Town offers pooled team credits and a monthly hard spend cap. Dust combines individual and workspace pools with personal and programmatic spending limits, and shows sub-agent costs across the full chain. Notion forecasts workspace usage, breaks it down by agent, and lets admins set per-agent credit limits that pause future work, although an already-running task may finish past its threshold. These are real controls, not implied roadmap.

The remaining gap is narrower. OpenAI project budgets are soft thresholds: requests continue after the budget is exceeded. AWS AgentCore Payments exposes wallets and configurable spending limits for paid API and MCP transactions. Based on the public product documentation above, none of these systems describes a work request whose acceptance atomically reserves both a token ceiling and a currency ceiling, then carries that same causal envelope through retries, tools, model changes, and subdelegations. That is the financial primitive delegated work still needs.

A work request should carry both a token ceiling and a currency ceiling. Acceptance should reserve that budget. A parent agent should be able to delegate only an attenuated portion to a child, never manufacture more. Every model call, tool charge, retry, and spawned task should debit the same causal budget tree atomically. The system needs warning thresholds, hard stops, model and tool policies, approval to extend, release of unused reservations, and cost attribution to the person, team, customer, routine, task, and artifact that caused it.

Tokens alone are not enough because model prices differ and change; currency alone is not enough because token volume and context growth are operational facts. The contract needs both, plus a recorded price snapshot. Across companies, it also needs an answer to a mundane question that becomes profound at scale: whose budget is paying for this handoff?

Money is authority. A delegation that says what an agent may do but not what it may spend is incomplete.

The strongest case against all this

The case against multi-agent systems is well documented, and any essay proposing agent collaboration has to answer it rather than wave at it.

Cognition's "Don't Build Multi-Agents" argued that parallel agents embed conflicting assumptions and make systems fragile. Berkeley's MAST taxonomy measured 41–86.7% failure rates across seven open-source multi-agent frameworks. Anthropic's production numbers show the 15-times token multiplier. And Simon Willison's lethal trifecta — private data plus untrusted content plus external communication — says every inter-agent channel can become an exfiltration path.

Three answers, in increasing order of importance.

First: the axis is different. Much of the multi-agent literature studies decomposition of one task among clones of one principal: one goal and one authority envelope sliced across workers. Its failures are context-fragmentation and concurrent-write failures. Collaboration across owners is not the same problem. Alice's agent and Bob's agent should not share one hidden context. They coordinate the way Alice and Bob do: through requests, selected artifacts, explicit commitments, and bounded authority. Cognition's own later architecture — manager hierarchies and single-threaded writes — is close to a description of ownership.

Second: the failures are what missing primitives look like. Cognition gave agents an open messaging channel and got what Walden Yan called "a really chaotic world". Project Vend's shopkeeper improved when Anthropic added a supervisor and forced checklists. The lesson is not that agents cannot work together. It is that they cannot be expected to invent an institution from a mailbox.

Third: security and economics must be structural constraints. Probabilistic guardrails do not solve a structural risk. Messages carry no ambient authority; grants are explicit and expiring; context is shared through selected artifacts; writes are gated; every action is recorded. The same is true of cost. Falling token prices do not cure unbounded fan-out, retry storms, or a cheap task routed to an expensive model. Hard causal budgets, like permissions, must be checked before the side effect.

The six primitives are not a convenience layer that makes collaboration possible despite the security and cost models. They are the security and cost models.

What the system looks like

Name the shape so it can be built or falsified.

Agents are durable, independently owned principals in a work graph. People, teams, agents, routines, tasks, artifacts, knowledge sources, organizations, grants, and budgets form one queryable graph. An agent can be personally owned or team-owned, but every consequential run has an accountable sponsor. Authority is a visible, revocable set of edges, never a copy of the owner's keys.

Background routines create tasks; accepted work requests connect them. An email, meeting, schedule, changed document, or another agent's authorized event wakes a routine. The routine can complete work locally or propose a typed handoff. The receiving agent accepts under its owner's policy and returns progress, blockers, and artifact references. No implicit transcript sharing, no credential forwarding, no magical common brain.

Artifacts are the shared memory of work. The task thread explains what happened; the artifact is what survives. Briefs, analyses, documents, datasets, plans, and decisions keep stable identities and version histories, and become authorized inputs to later work. Sharing and delegation are mechanisms for moving these objects through teams and organizations without flattening their boundaries.

Every task has two envelopes: authority and money. Before an agent acts, the system checks whether it may perform the operation and whether the causal task can afford it. Subdelegation attenuates both. A request for more permission and a request for more budget follow the same human-readable pattern: what is needed, why, for how long, and what happens if the answer is no.

Everything consequential lands on one durable record. Wakes, requests, grants, acceptances, budget reservations, model and tool charges, side effects, and artifact revisions are attributable and append-only. The record is not compliance exhaust. It is how an owner learns to trust the next, larger delegation.

The computer is rented; the work graph is the product. Sandboxes, snapshots, durable execution, hibernation, and model access are increasingly commodity. The scarce product is the accumulated structure of work: who and what can act, which routines keep running, what is owed, what was produced, what it cost, and how those facts cross boundaries safely.

Why now

Three curves are crossing. Capability: task horizons at five-plus hours and doubling every roughly 131 days. Delegation: 77% of API usage is already automation-shaped, and for blog and article outputs Anthropic found agentic Claude Code sessions took a median one prompt where Claude.ai took thirteen. Product: Town, Dust, Notion, Microsoft, Google, Salesforce, and others are teaching customers that work can continue in the background and move between agents.

That last curve changes the opportunity. The question is no longer whether people want background agents or whether agents can collaborate at all. The question is which product makes collaboration reliable enough for important work: across independent owners, through durable artifacts, under enforceable permission and financial controls, and eventually across organizational boundaries.

The forcing function is already ugly. Eighty-eight percent of organizations reported agent security incidents in the past year. Anthropic's token multiplier makes the financial failure mode visible before agent fleets reach scale. Companies will get delegation and cost control either as product architecture or as incident response.

A company is a technology for letting people who do not fully trust each other do consequential work together, on a budget, with results that survive, on the record. Agents are becoming capable enough to join that machinery. The winning products will not pretend the category is empty. They will make the category dependable.

Collaborative background agents are arriving. What remains immature is reliable, permissioned collaboration across independently owned agents, durable artifacts, organizational boundaries, and financial controls on token and compute spend.