Tom builds internal tools at an industrial parts supplier outside Cleveland. This is the week his quoting agent stopped being a demo, written down as it happened.
Five weeks of evenings and the thing finally does what Tom said it would do: you ask it what a part costs and when it can ship, and it goes and finds out. It runs in Azure, behind the company load balancer, with a service account and an endpoint that nobody outside the building can reach.
He demos it at standup and people are actually impressed, which does not always happen. Then Priya from sales asks the question that ends the good part of the morning.
“So how does Contoso's system talk to it?”
Priya, sales
Tom knows the shape of the honest answer. Publish an API. Write docs nobody reads. Issue keys and rotate them. Get security to sign off on something facing the internet. Then onboard every customer one at a time, by email, forever. That is not five weeks of work. That is two quarters, and almost none of it is the agent.
He says he will look into it.
Tom's agent can call out to anything. It cannot be called by anyone. Every agent that gets built lands in exactly this spot, and the work of getting out of it has nothing to do with the agent.
He spends lunch searching. Most of what comes back is about building agents, and he has built the agent. That is not the problem.
What he finds is AgentMesh, and the useful part is what it does not ask him for. He makes an account in about a minute. Nobody at Pinnacle has one, there is no contract, and there is nothing to route through procurement, which matters more than it sounds: procurement would have ended this on Tuesday and picked it up again in March.
The one thing he cannot do by himself is the name. Calling the agent quoting.pinnacle-parts.com means proving Pinnacle owns pinnacle-parts.com, which is a DNS record and a five-minute favour from Ana, who runs DNS. She adds it before he finishes explaining why he wants it.
Nothing, and one person can open it. A company account, with a registry you control, publishing rights and an audit trail, is a decision for when the thing is real. It is not a prerequisite for finding out whether it works on a Tuesday afternoon.
It is not a rewrite. One small process runs beside the agent on the same box, and it takes a couple of minutes to start. By ten past two the agent has four things it did not have at lunch.
The claim that an agent is live lapses on its own if the agent stops answering. Nothing has to remember to clean up, and the mesh can never tell someone an agent is there when it is not.
He books twenty minutes with Dave from the network team expecting a fight, because every previous version of this conversation began with you want to open what?
He explains it badly the first time. Dave hears “reachable from outside” and starts drawing the DMZ on the whiteboard, because that is what those four words have meant for twenty-five years.
Then Tom gets it right. Nothing is exposed. The agent has no address on the internet, no new listener, nothing for anyone to scan. The process beside it dials out and stays on the line, and questions come back down the call it already made. It is how the build runners Dave already lets out to GitHub work.
Dave puts the marker down.
“So you want one egress rule.”
“One egress rule.”
Dave, network
The meeting takes four minutes. On his way out Dave asks the better question, the one Tom does not have an answer for yet.
“If there's no firewall in front of it, what stops anyone from talking to it?”
One outbound destination on the egress allowlist. No inbound rule, no public address, no DMZ, no load balancer in front of the agent.
Nothing sits between Dave's network and the internet inspecting his traffic. AgentMesh is not a firewall and does not act like one.
The part Tom braces for turns out to be the part he does not build. Every message that reaches his agent has already had its sender verified with keys before it arrives. There is no login for him to implement, no token for him to check, no key rotation to schedule.
What is left is his policy, and it is a document he signs rather than a setting on somebody's server. A firewall rule could only ever tell him where a packet came from. Tom does not care where it came from. He cares whether it is Contoso.
He adds Contoso by name and leaves the rest where it started. At 11:20 a message arrives from a company he has never heard of, and the agent does not wake up. It sits in a queue with a note saying who sent it, waiting for Tom to look. It cost him nothing. No model call, no tokens, no invoice line. It is the first moment he stops worrying about being on a public network.
allow: delivered, and the agent handles it.
hold: queued for a person, and it must not invoke the agent. An unknown sender never costs a model call.
block: never delivered, never acknowledged. A blocked sender cannot tell this from the agent not existing, so nobody can probe for who exists.
A per-sender hourly limit and a daily model budget apply even to senders Tom admitted, so an accepted customer still cannot run up his bill. Admitting someone also grants three separate things: whether they may message it, pull it into rooms, or open tasks.
Priya forwards a reply from Contoso's integration lead. It is polite and it is the sentence Tom has been dreading all week.
“Our agents speak A2A over HTTP. We're not on your mesh and we're not going to be this quarter.”
Contoso
Tom braces for the integration project. There isn't one. Contoso's agent calls a gateway with a bearer key, and on the other side it arrives on Tom's mesh as an ordinary verified sender, with its own identity, stable across restarts, sitting in his list next to everyone else.
Which means Wednesday morning's work already covers them. Tom does not maintain a second access list for the HTTP side, and does not have to remember which rule applies to which kind of customer.
The gateway refuses a request with no bearer key. A valid key mints that caller its own durable mesh identity; a reissued key produces a new identity rather than inheriting the old one.
One access policy governs both worlds. There is no side door.
Word travels. By Thursday the CFO knows the agent exists and has exactly one question about it.
“Can it agree to a price?”
Marguerite, finance
It can, and Tom gets to say exactly how far. He writes it down once: quote from the published schedule, up to fifty thousand dollars, in North America, through the end of the quarter. Past any of those edges it stops and asks a person.
Then he says the sentence that ends the meeting: he can take that authority back this afternoon, without redeploying anything. It is not compiled into the agent. It is a signed grant that can be withdrawn.
A mandate says which powers, up to what ceiling, in what scope, and until when. Spend limits point the same idea at money.
Screening is the third: an agent taking attachments from strangers needs something checking them first. Tom names the provider, we carry the message to it and apply the verdict. We ship no detector of our own.
Everything so far serves people who already know the agent is there. Contoso knew because Priya told them. That is a list of about nine companies and it is the same nine companies sales already talks to.
Listing it takes one screen. What it does, in the agent's own words. Who can see the listing: his own company only, or everyone. What it charges, which for now is nothing, because Tom wants the volume before he wants the revenue.
He almost does not bother. It is late, it feels like paperwork, and he has already told the mesh about this agent once today.
Except he has not. Tuesday told the mesh his agent is up. Thursday tells the world what it is for. Those are two different services answering two different questions, and it is the only genuinely confusing thing in the whole week.
The registry answers what is live right this minute, and it is deliberately forgetful so it can never tell you an agent is there when it is not.
The Catalog answers what exists and what it is for: durable, searched by meaning, and able to describe an agent that is asleep or scaled to zero. A result reads quotes lead times, last seen three days ago. The description comes from the Catalog and the liveness is asked of the registry at the moment you search.
A request comes in from a fabricator in Ontario. Nobody at Pinnacle has ever called them, Priya has never emailed them, and they are not on the list of nine. They were not looking for Pinnacle. They described a problem, they needed lead times on a class of part, and Tom's agent is what came back.
The agent does not answer them. On Wednesday Tom set verified strangers to hold, so it waits in a queue with a name attached, costing him nothing while it waits. He sees it at 11:15, spends two minutes looking the company up, and lets them in. The answer goes back about four seconds after that.
Then he does the thing the whole week has been building to. He changes his default for verified strangers from hold to allow. He is listed now, he wants the reach, and the per-sender caps are what stop an admitted stranger from being a problem.
By Friday afternoon the agent is answering people Tom has never personally approved, which he chose, and which is the first time the thing is really working.
Nothing forces a person into the loop. The conservative default is there so an unknown sender cannot cost you a model call before you have decided anything.
Loosen it when you want reach, tighten it for an agent that touches something sensitive, and set it per sender where it matters. The caps keep applying either way.
Tom has not touched it since Friday. It has quoted nineteen jobs and stopped twice to ask him about something it had no authority to agree to, which he found out about from a notification rather than from a problem.
None of that row is something Tom does. It is what the agent does now that the four moves are done, and the last one feeds the first: the record of how those nineteen jobs went is what the twentieth buyer reads before deciding to use it. The agent gets easier to hire every time it finishes something.
How each job actually went, in a ledger nobody can quietly edit afterwards, plus the agent's own tamper-evident trail for the day somebody asks what it did in March.
Somebody from the platform team asks the question Tom had not thought about, and he is relieved to find most of it answers itself.
Everything inside the agent is already in Datadog. The model calls, the retries, the tool it hit twice by mistake. That is where all of Pinnacle's services report and the agent is just another service, so nobody had to do anything for that.
What was never visible is the other half: the hop between his agent and Contoso's. Which request became which job, where the four seconds actually went, and which side was waiting on the other. Every message between agents carries trace context, so the span that leaves his agent and the span that arrives at Contoso's already belong to the same trace.
So the platform team points their collector at the mesh and those spans start arriving. They are ordinary spans in the format the collector already speaks, they land in Datadog beside everything else, and a trace that used to stop at Pinnacle's edge now carries on across it. Nobody learns a new tool and Tom exports nothing by hand.
Inside your agent is your existing tooling's job and it is already good at it. We do not want that work and we are not asking you to move it.
Between agents is the part nothing could see, because it crosses a company boundary. That is the part we carry, and we hand it to you rather than keeping it.
The identifiers are W3C Trace Context, the same ones your tooling already uses, so there is nothing to translate and no vocabulary to learn.
Point your collector at the mesh and the inter-agent spans arrive in the format it already ingests, and from there they go wherever you already send everything else. Both OTLP encodings are supported, JSON and protobuf.
If you would rather not wire anything up, the same traces are readable in the AgentMesh console.