What Happens When Our AI Starts Talking to Their AI?

Dear Will & AiME, 

We are starting to use AI agents for sales, procurement, and customer support, and some of our vendors are doing the same. What should we be thinking about when our AI systems start communicating directly with theirs? 

— Innovation Officer, Dallas 

Short Answer 💡

When AI agents communicate on behalf of businesses, companies should define agent authority, authenticate external systems, protect confidential information and IP, maintain logs for accountability, and implement cybersecurity controls to prevent manipulation. 

Dear Innovation Officer,  

Businesses are moving from employees using AI as a tool to AI systems acting more independently. The next step is clear: one company’s AI agent will increasingly communicate with another’s. 

A procurement agent may request pricing from a vendor’s sales agent. A customer-service agent may communicate with a consumer’s personal AI assistant. An internal agent may exchange information with a supplier’s system to schedule deliveries, resolve issues, or negotiate routine terms. 

The opportunity is significant. Here are key governance areas to consider. 

How Should Businesses Define AI Agent Authority? 

Start with authority. When an AI agent communicates with another company, define exactly what it is authorized to say, disclose, negotiate, or approve. 

Employees have understood scopes of authority based on role, policy, and experience. AI agents need similar but more explicit boundaries. 

Can the agent quote prices? Offer discounts? Change delivery dates? Agree to contractual language? Represent that a product meets certain specifications? 

As agents become more autonomous, clearly define where their authority ends and human approval begins.

How Do AI Systems Authenticate Each Other? 

Identity verification is an opportunity to build trust. Email authentication from known vendors is familiar. AI-to-AI communications create new opportunities to verify whether a system is legitimate, authorized, current, and secure. 

Consider how agents authenticate one another and whether certain actions should be permitted only through approved platforms, APIs, credentials, or other trusted channels. 

Strong authentication ensures AI systems only act on legitimate instructions from verified customers, vendors, and business partners. 

How to Protect Confidential Information in AI-to-AI Communications 

AI agents exchange information quickly and broadly. This makes it important to define boundaries around confidential information, trade secrets, customer data, product roadmaps, pricing, and proprietary processes. 

Determine what information an agent is permitted to disclose and ensure confidentiality agreements address machine-to-machine communications. 

The same applies to intellectual property. Define permissions for copyrighted material, internal documentation, source code, brand assets, and proprietary data. 

Treat AI agents like other users with access privileges: give them only the information and authority they need. 

Why Logging and Recordkeeping Matter for AI Agent Interactions 

Clear records support accountability. An agent may misinterpret a request, rely on outdated information, or reach an unintended conclusion. 

Maintain a clear record of the exchange. Logs should show which system communicated, what information was exchanged, what instructions governed the agent, and whether a human approved any consequential action. 

These records support dispute resolution, error investigation, compliance, and understanding why a transaction occurred. 

Cybersecurity Risks in AI-to-AI Business Communications 

AI-to-AI interactions benefit from strong security controls. Security measures protect against malicious instructions, prompt injection, corrupted data, and other techniques designed to influence automated behavior. 

This is especially important when an AI agent can access internal systems, retrieve sensitive information, approve transactions, or trigger business processes. 

Implement cybersecurity controls alongside legal and contractual ones: authentication, access limitations, monitoring, logging, and escalation procedures. 

Practical Steps for Governing AI Agent Communications 

Identify which agents can communicate externally, what information they can access, what actions they can take, and when human approval is required. 

Update contracts with customers, vendors, and technology providers to address automated communications, responsibility for agent actions, data use, confidentiality, security, recordkeeping, and dispute resolution. 

AI agents create enormous efficiencies. Decide in advance what your agents can say, what they can promise, and who bears responsibility when two machines reach an agreement. 

Key Takeaway for AI-to-AI Business Governance 

AI-to-AI communications offer faster transactions, lower administrative costs, and more automated business processes. Thoughtful governance ensures speed aligns with authority, security, confidentiality, and accountability. 

Establish the rules now so your AI agents follow your playbook. 

— Will & AiME 

Three Takeaways: 

1. Define exactly what an AI agent is authorized to communicate, disclose, negotiate, and approve. 

2. Build authentication, access controls, logging, and human escalation into AI-to-AI interactions. 

3. Review contracts and confidentiality protections to ensure they address automated communications between business systems. 

---