The Agent Inbox Is an Authority Boundary

Cross-session messaging removes a clumsy human relay. One agent can ask another for a finding, send a status update, or coordinate work without somebody copying text between terminals. That is real leverage. It also creates a new route by which one worker can influence another worker's actions.

Treating that route as harmless chat is the first mistake. An agent does not experience a message as office conversation. It consumes the message as input to its next decision. A request can change scope, replace an assumption, expose a path, or persuade the recipient to use a tool. The inbox sits upstream of production behavior even when the message itself never enters the repository.

Our position is that every machine-readable inbox is an authority boundary. If a message can alter execution, the factory must know who sent it, what that sender may request, and which evidence is required before the recipient acts.

A session name is a label, not a verified identity claim. Telling one sender apart from another takes an additional identifier and the context around it, and even a correctly resolved sender does not tell you whether that session may redirect a deployment worker, approve a migration, reveal protected context, or cancel another unit of work. Identity answers who. Authority answers what that identity is allowed to cause.

Give each agent a narrow role and make message permissions follow it. A research worker may report findings but not assign implementation. A builder may request a test but not waive it. A verifier may reject an artifact but should not rewrite the acceptance contract to make the artifact pass. The useful rule is not that agents may communicate. It is that each message type has an authorized sender, recipient, payload, and effect.

Do not bury those rules in the same prompt that receives the message. A worker can misunderstand prose, lose it during context compression, or be convinced that an exception applies. Enforce the route outside the worker with identities, capabilities, schemas, and state transitions the model cannot edit.

An authorized sender can still be wrong. It may carry a stale assumption, repeat content from an untrusted document, report success against the wrong branch, or summarize a failure into something that sounds complete. Permission to send is not proof that the payload is true.

Separate notification from acceptance. A message may tell the recipient that an artifact exists, but the recipient should fetch that artifact through a governed path, check its version and producer, and evaluate it against the current contract. A claim that tests passed should point to retained results. A claim that a dependency changed should resolve to recorded state. Conversation should locate evidence, not replace it.

This matters more as agent count rises. Fast messaging can spread one bad assumption through several workers before a person notices the first mistake. A factory limits that blast radius by making consequential claims independently reproducible and by invalidating downstream work when an input changes.

Messaging systems fail quietly. A recipient may be busy, gone, restarted, or waiting on a different dependency. A sender can mistake delivery for acceptance and continue building on a handoff nobody consumed. Human teams patch this with reminders and meetings. Agent factories need explicit state.

Record whether a message was delivered, acknowledged, accepted, rejected, or expired. Put deadlines on requests whose value decays. Make retries idempotent so a delayed response cannot trigger the same action twice. Escalate unresolved decisions to a named human owner when the consequence requires judgment. The transcript is useful, but the state machine is what prevents silence from becoming an invisible branch in the plan.

This is where cross-session communication stops being a feature and becomes infrastructure. The factory must survive a worker disappearing halfway through the exchange without relying on somebody to remember what the missing session was supposed to do.

Once the messaging route has enforceable authority and durable state, routine coordination becomes machine work. Agents can request inputs, report completion, route failures, and wake the next stage without a person collecting updates. That will eliminate jobs built around moving information between specialized workers. Calling the same work oversight does not make it less repeatable.

People remain responsible for the decisions with consequences: which roles exist, which permissions they receive, what evidence is sufficient, when an exception is acceptable, and where the machine must stop. Those decisions move higher in the system. They do not justify keeping a person in every message loop.

Let the sessions talk. Then govern what their words can do. The winning factory will not be the one with the busiest agent conversation. It will be the one that can prove every consequential message crossed an authorized boundary, resolved to durable evidence, and advanced work without turning trust into another manual job.