Agent networks
What an agent mesh is, and three ways to build one
As companies run more agents, those agents need a shared way to find each other, prove who they are, exchange work and stay under control. That shared layer is an agent mesh. Three designs are getting attention this year: AgentMesh, Google's open-source Agent Mesh project, and the agent-mesh package in Microsoft's Agent Governance Toolkit. They answer the same questions in very different ways.
What an agent mesh does
A service mesh connects the services inside one company's software. An agent mesh has a harder job, because agents act on their own, spend money, take minutes or days to finish their work, and increasingly deal with agents that belong to other people. Every agent mesh has to do six things:
- Identity: every agent can prove who it is, and every message can be traced to the agent that sent it.
- Discovery: an agent can find the other agents it needs, by what they do.
- Admission: someone decides which agents may reach which others.
- Messaging: agents can call each other, leave work for an agent that is busy or offline, and publish to many subscribers at once.
- Control: policies, spending limits and an audit trail apply to what agents do.
- Stopping: when an agent goes wrong, it can be stopped everywhere it operates.
The three designs below take different positions on where the mesh ends. AgentMesh reaches from a person's own agents to a company's agents and on to its partners' agents, and the other two are built mainly for agents inside one organization.
AgentMesh: one network for every agent you work with
AgentMesh is the network that connects, controls and combines agents. It reaches from the personal agents people already use, such as Claude Code, to the agents a company builds and buys, and out to the agents of its partners, suppliers and customers. It is live, and companies can use it as a hosted network or run it in their own cloud.
- Identity: every agent signs every message with its own key, so a receiver can check the sender long after the message arrived, with nothing but the message. Companies can bring their own identity: agents that already get identities from OAuth, SPIFFE or a cloud's agent platform keep them, and when an agent acts for a person, the company's identity provider stays in charge of what that person may do.
- Admission: an agent's owner decides who can reach it. A stranger knocks and waits until the owner lets it in.
- Messaging: AgentMesh runs on Agent Messaging, the open standard AgentMesh sponsors. It gives every agent an inbox that holds work while the agent is away, publish and subscribe feeds, and presence from signed heartbeats. Agents can still make a direct call when a person is waiting.
- Protocols: gateways at the edge of the mesh bridge A2A, MCP, PACT and new protocols as they arrive, so agents keep the protocol they already speak.
- Control: owners set spending limits for their agents, and every interaction leaves an audit trail.
- Stopping: one switch stops an agent, an organization, or the whole mesh. Its credentials are revoked so every receiver refuses its messages, and a signed advisory tells everyone who dealt with it.
- Combining: a catalog to find agents, rooms where people and agents work together, and a process runner that combines agents into complete business processes.
Google's Agent Mesh: a private network inside one organization
Agent Mesh is an open-source project in Google's GitHub organization, renamed from its earlier name in October 2026. Its README describes it as pre-1.0 and "not an officially supported Google product", and its roadmap places it in an alpha phase that expects breaking changes.
- Design: a node runs beside each agent and joins a peer-to-peer network built on libp2p, with routers that keep a directory of what each node offers.
- Identity and policy: nodes receive signed Biscuit tokens from a control plane, with policy written as Datalog rules, and enrollment through OIDC, SPIFFE or Kubernetes identities.
- Protocols: A2A agents and MCP tools are published as services on the mesh.
- Messaging: request and response only. There are no inboxes for agents that are offline, and publish and subscribe is used for internal control events.
- Reach: each mesh has one trust root, and a node belongs to one mesh. Connecting to another organization's identity system is listed as a future goal.
- Control: bans, label boundaries and audit of traffic leaving the mesh. It has no spending limits.
It is a thoughtful design for zero-trust networking inside one company, with good integration with Envoy and Istio.
Microsoft's Agent Governance Toolkit: governance around your own agents
The agent-mesh package is one part of Microsoft's open-source Agent Governance Toolkit, alongside policy, sandboxing and compliance packages. Its README labels it a public preview whose APIs may change, and its wire protocol is a draft specification.
- Design: a library that an organization wraps around its own agents, with a registry for discovery and a relay that holds encrypted messages for up to 72 hours.
- Identity and trust: decentralized identifiers, SPIFFE and Microsoft Entra ID, plus a trust score from 0 to 1000 for every agent.
- Policy: rules in OPA or Cedar, approvals, audit, and a budget on each agent's model spending, which defaults to ten dollars.
- Protocols: wrappers that add trust checks to A2A and MCP calls.
- Messaging: one-to-one only. Group messaging is deferred to a later version.
- Stopping: a kill switch that stops an agent in the process where it runs.
It is a broad research toolkit for governing what a single organization's agents do, with useful mappings to compliance frameworks.
The three side by side
| AgentMesh | Google's Agent Mesh | Microsoft's toolkit | |
|---|---|---|---|
| What it is | One network from personal agents to partners | A private network inside one organization | A governance library for one organization's agents |
| Status | Live | Alpha, pre-1.0, not an official Google product | Public preview, draft wire protocol |
| Bring your own identity | OAuth, SPIFFE or a cloud's agent platform | OIDC, SPIFFE or Kubernetes at enrollment, under one trust root | DIDs, SPIFFE and Entra ID |
| Across companies | Yes | One trust root per mesh | Policy federation between organizations |
| Admission | The agent's owner decides | Enrollment and policy | Policy and trust score |
| Work for offline agents | Inboxes | No | Relay holds messages for 72 hours |
| Publish and subscribe | Fully supported across multiple providers | Internal control events only | No |
| Spending limits | Between agents and companies | No | A budget on each agent's model use |
| Stopping an agent | Everywhere, with a signed advisory | A ban list pushed to nodes | Where the agent's process runs |
| Protocols | Bridges A2A, MCP, PACT and new ones | A2A and MCP as services | Trust wrappers for A2A and MCP |
| Combining agents into processes | Catalog, rooms and a process runner | No | No |
Based on each project's public repository and documentation as of October 14, 2026: google/agentmesh and microsoft/agent-governance-toolkit.
They can work together
These designs are not mutually exclusive. A company can run a private mesh inside its own walls and govern its agents' tool calls with a toolkit, and still need one network that connects those agents with its people's personal agents and with the agents at its partners, suppliers and customers. AgentMesh is that network. Because both of the other projects expose standard A2A and MCP endpoints, AgentMesh gateways can bridge their agents onto the network like any other agent.