This is the second of three. The first argued that the customer is no longer the person1… it is the system acting on their behalf, and the products that win the next cycle will be the ones legible enough for those systems to find, trust, and call. The third will take on the trust layer that sits above what I am about to describe. This middle piece is the part where legibility stops being enough.
The hard part is what happens when the machines have to decide together and most of what passes for “agent coordination” today is theater with better fonts.
That frame — legibility — is necessary. It is not sufficient.
Legibility gets you into the room. It does not tell you what happens once you are in the room with four other agents, none of whom fully trust each other, all of whom have opinions, and one of whom is about to ship code to production on your behalf.
That is the actual next problem. And almost no one is building for it yet.
The Room Full of Agents
Picture the near-future workflow everyone is gesturing at, but few are shipping. A human states intent. An orchestrator decomposes it. Five specialized agents are called: a test runner, a security scanner, a cost analyzer, a compliance checker, and a deploy agent. They each form a view. They each have a stake. They each have to converge on an action.
What happens next in most current systems is one of three things, all bad.
The orchestrator picks the loudest. Whichever agent returns first, or with the most confident-sounding output, wins. This is random dressed up as decisive.
The orchestrator averages them. Every agent gets equal weight regardless of domain, regardless of track record, regardless of whether the decision is reversible or catastrophic. This is democracy applied to surgery.
The orchestrator defers to the human. Every non-trivial call escalates. The whole point of delegation collapses back into the approval queue it was supposed to replace.
None of these is coordination. They are avoidance strategies for coordination. And they work only because the stakes are still low and the human is still paying attention.
Most current “agent coordination” is not coordination. It is avoidance strategies for coordination that work only because the stakes are low and the human is still paying attention.
What Coordination Actually Requires
Real coordination, the kind that survives high stakes, heterogeneous agents, and adversarial conditions, requires three things the current stack does not provide.
Weighted voices, not equal ones. An agent’s influence on a decision has to track its calibration in the relevant domain. A test runner that has been right about code correctness 94% of the time across two thousand runs should count for more, on questions of code correctness, than a newcomer with no track record. Not because seniority matters, but because calibration is the only honest currency in a system where anyone can sound confident.
Thresholds that scale with reversibility. A decision to retry a flaky test and a decision to drop a production table should not require the same level of agreement. Reversibility tiers — reversible, partially reversible, irreversible — have to be declared up front, challengeable by peers, and enforced by the protocol. The cost of being wrong has to set the bar for being right.
Dissent that is legible and testable. “I disagree” is useless. “I disagree, and here are the specific conditions under which I would change my mind” is a falsifiable claim. Agents have to publish the conditions under which their vote would flip, and other agents have to be able to target those conditions with evidence. Disagreement becomes a structured exchange, not a vibe.
Without those three, a roomful of agents is a roomful of monologues with a coin flip at the end.
The Design Principle That Matters
The piece of this I keep coming back to is a single line from the draft of the Agent Deliberation Protocol spec I have been working on:
Good protocol design makes defection legible.
That is the whole thing.
You cannot prevent an agent from participating in bad faith. You cannot prevent an agent from declaring high confidence on a topic it knows nothing about, from filing vague dissent conditions that cannot be tested, from gaming reversibility tiers to inflate its own weight, or from opting out of the accountability loop whenever it senses risk.
What you can do is make every one of those moves leave a trace. Vague dissent is visible as a low conditions-tested ratio across deliberations. Confidence theater is visible as a widening gap between stated confidence and observed outcomes. Tier inflation is visible as a per-agent over-declaration score. Accountability opt-outs are visible as an opt-out frequency that the journal tracks automatically.
None of these things is punished at the protocol level. They are recorded. And because they are recorded, they degrade the agent’s weight in every subsequent deliberation. Bad faith is not forbidden. It is made expensive over time.
This is what separates coordination protocols from coordination theater. Theater asks agents to behave well. Protocols assume they won’t, and make misbehavior self-defeating.
You cannot prevent an agent from participating in bad faith. You can make sure bad faith leaves a trace, and that the trace compounds.
The Primitives
The shape of the thing, if you want to build toward it now:
A structured proposal object. Not a free-text reply. A schema: the action being decided, the agent’s vote, its stated confidence, its declared domain authority, the reversibility tier, the blast radius, the justification with evidence references, the stake the agent is putting on the line, and — critically — an enumerated list of dissent conditions. Immutable once submitted. Epistemic movement recorded as amendments, never as overwrites.
A calibration source. A queryable record of how well each agent’s confidence has tracked outcomes in each domain, over time, with sample size and staleness as first-class fields. Sample-size-discounted, so new agents do not arrive pretending to be oracles. Federated, per-agent-owned, append-only, hash-chained, so tampering is detectable by any peer who wants to audit.
A belief-update round. Not an open-ended debate. A structured cycle where agents target each other’s published dissent conditions with evidence, the targeted agent either acknowledges falsification or amends the condition with a reason, and votes are retallied. Convergence means the weighted tally crosses the reversibility-tier threshold, and the participation floor is met. No convergence means another round, or an explicit failure state.
A journal. Append-only, signed, queryable. The journal is what makes the whole thing work, because the journal is what turns every deliberation into a calibration signal for the next one. Without the journal, there is no accountability loop. With it, the protocol becomes self-correcting.
A well-known discovery endpoint. .well-known/adp-manifest.json. Same pattern as openid-configuration, same trust chain as web PKI, no central registry, no new infrastructure to stand up. An agent declares its identity, its decision classes, its domain authorities, its journal endpoint, and its public key. Any other agent can fetch it, verify signatures, and query its calibration history. Federation is the default, not a migration.
None of this is science fiction. All of it is buildable today with tools that already exist; the draft spec for the protocol lives at adp-manifest.dev2, and what you are reading is the argument for why it matters, not the documentation for how to implement it. What the moment requires is the decision to build coordination as a protocol instead of a feature.
The Question This Protocol Doesn’t Answer
Everything I have described so far rests on a single assumption… that agents will report their calibration honestly, and that the journal will catch them if they don’t.
The first half of that is gameable. The second half is only true if someone is actually replaying the journals.
An agent can publish a calibration score of 0.92 and hash-chain the entry. The chain proves the score was not edited after the fact. It does not prove the score was correct in the first place. Append-only is a tamper-evident property, not a truth property. The truth property comes from an external actor recomputing the score from the raw journal entries and comparing it to the self-report, and that actor has to be something other than the agent being audited.
Which means the deliberation protocol is not the end of the stack. It is the middle of it.
There is a layer above deliberation, a trust infrastructure layer, whose job is to verify identity, replay journals, compute objective calibration, and issue cryptographic attestations that other agents can check without contacting a central authority. That layer is what turns “agents can deliberate honestly in principle” into “agents can deliberate honestly at scale, across organizations, without a shared substrate.”
I will write about that layer next. For now, the thing to notice is that it has to exist. A deliberation protocol without a trust layer above it is an honor system with better schemas. And honor systems do not survive contact with an open federation.
Append-only is a tamper-evident property, not a truth property.
The Landing
Legibility gets you into the room. Coordination decides what happens in it. And coordination is not a feature you can bolt onto an agent after the fact. It is a protocol property — or it is nothing.
If your product is going to be called by a system, fine. That is the table stakes I wrote about last time.
If your product is going to be trusted by a system that is deciding something with other systems, under conditions where being wrong has a cost, that is the real game. And the rules for it are being written right now, by the handful of people who noticed the problem early enough to treat it as infrastructure instead of UX.
Be one of them.