Jean-Denis Greze reframes agent-to-agent systems as search systems whose quality depends on putting the right information into the context window before a response or tool call.
2
Privacy prevents the ideal single agent from accessing all information, so practical systems must choose how much power to give agents and where to require human approval.
3
Greze expects shared company wikis and other silos maintained by AI to spread first, while cross-company agents will depend on narrow use cases where organizations accept shared access rules.
Summary
Jean-Denis Greze argues that agent-to-agent is a misleading way to frame the problem. The real task is search: before an agent responds or calls a tool, it needs the right information in its context window. The ideal system would give one agent access to every relevant email, company record, and government document, but privacy creates the transaction cost that prevents this. Greze compares five practical approaches: shared trust boundaries, privacy-preserving tools, shared silos maintained by a sweeper agent, humans who approve requests, and a black box that searches privately before asking only the relevant owner for permission. He expects AI-maintained company wikis to produce the fastest gains, especially in small, high-trust organizations. He is also direct about the risks, including prompt injection, incorrect information that persists, accidental disclosures, and audit problems. Cross-company systems may emerge through narrow financial use cases, but Greze does not claim to know whether people will trust agents to make privacy decisions automatically.
Greze rejects agent-to-agent as the main framing. He says most LLM systems are search problems, because the result depends on whether the context window contains the right information immediately before the model responds or makes a tool call. Earlier systems relied on humans to populate context manually, then retrieval tools searched across systems. Current agentic search gives the model many tools and asks it to search through available content. The important call is the one that has the right context, and Greze describes the system as engineering that moment rather than coordinating people or multiple model personalities.
Greze asks the audience to imagine one agent with one context window and access to every person's email, every company's information, and every government's information. That agent would have the best possible information before acting. He calls this a multi-agent world in practice, because the number of agents is less important than the information available to the agent making the decision. The obstacle is privacy and security. People will not allow a general agent to inspect their email continuously, even though such an agent would be powerful.
Privacy is the transaction cost that blocks perfect information
Greze uses the Coase theorem to explain the limit. If people have the right information and face no transaction costs, negotiations can produce an economically ideal outcome. An all-seeing LLM would approximate that condition, but privacy prevents all the world's contacts and records from entering one context window. He proposes judging multi-agent systems by how closely they approximate this impossible ideal. The better a system gets the information needed into the important LLM call, the closer it gets to the optimal result.
Shared trust boundaries help now but create another silo
The first strategy gives an agent access to everything inside a shared trust boundary. Greze and his wife share an agent that can read both inboxes, including messages from before they were married. In a company, an HR agent might have the access of the most junior HR employee, allowing the whole HR team to ask questions. Greze says this model is popular because it resembles existing SaaS security practices. Its limits are that humans still have to reason about all the data, and better models do not remove the silo. A person has created a new silo around the shared agent.
Privacy-preserving tools trade information power for permission
The second strategy creates tools that expose a limited result instead of raw data. Greze gives the example of finding someone at a company who knows a CFO at Acme Corp. Rather than opening everyone's Gmail, a tool could inspect those inboxes and return only relationship-strength scores for relevant contacts. The agent could then ask Bob whether he wants to confirm the connection and draft an introduction. Greze says Town uses similar ideas and asks whether users would accept each tool's privacy trade-off. The approach still depends on humans to design, explain, and approve the trade-off.
AI-maintained shared silos may spread information with less manual work
A shared silo gives a team a common wiki, database, or set of skills where agents can find information that is safe to share. Greze's preferred version adds a sweeper AI inside each private silo. The sweeper follows a policy, reviews new information at the end of the day, and moves suitable material into spaces shared across the company. One option asks a human to approve each proposed contribution. Another asks the LLM to enforce a policy automatically. Greze expects smaller, high-trust companies to adopt this sooner, with finance and HR data kept private.
The fourth strategy uses people as the path between agents. One agent asks another person's agent for information, and that person approves both the search and the release of the result. Greze says this is inefficient when only a small number of people actually hold the answer. Asking a 100-person company about a connection could ping all 100 employees on Slack. The approach gives people control, but it creates a large number of approval requests for questions that may concern only one person's private network.
A black box can ask permission only at the sharing step
Greze's fifth strategy lets an unseen LLM search across private silos without asking every person first. The system identifies the information needed for the eventual tool call, then asks only the people who own that information for approval. In the Acme example, all agents search privately, the system identifies Bob as the strongest connection to the CFO, and Bob receives one request to approve sharing that fact. This design requires trust in the black box and careful control of the final human-in-the-loop step. Greze warns that a query about recruiters could accidentally reveal that someone is interviewing elsewhere.
Automatic sharing needs correction, audit, and reversal
Greze expects AI-maintained wikis and databases to bring the fastest returns, but he lists serious failure modes. Prompt injection in an open silo can contaminate agentic search. A mistaken fact can enter a shared wiki and persist, as his own system still calls his renamed agent 'Apex' instead of 'Ivy'. Wrong disclosures can have very different consequences, from no impact to an employee being fired or a customer suing the company. Systems also need answers about who approves decisions, what gets logged, and whether actions can be reversed. A black box cannot remain completely unauditable because company security teams will eventually need to inspect it.
"If you put the right information in the context window then based on the intelligence, so to speak, of the LLM, you will get the best result possible."01:32
Who should watch
You are building systems that need information from several people's private data and need a framework for deciding where approval belongs.
You work on enterprise search, shared wikis, agent memory, or tool permissions and want concrete designs for trading information access against privacy.
You are considering agent systems that cross company boundaries and want to understand the trust and audit problems before deployment.
