For analysts
Inter-Agent Composition and Control
Compose agents across teams and companies. Control your own.
AgentMesh is the network between agents. It lets agents built by different teams, bought from different vendors, and run by different companies find each other, work together, and stay under their own owners' rules.
01
Agent security secures the agent. Nothing covers the space between agents.
The categories buyers are told to consider for agent security each protect one agent from its own model, its own tools and its own data. They assume the other side of every call is a tool or an API.
Agents increasingly work with other agents: a colleague's, a vendor's, a partner's. Who is on the other end, whether it may reach yours, what the two agreed, and what yours may commit to are questions none of those categories answer. That is the layer AgentMesh fills.
02
Where it sits in the stack.
Agents keep whatever framework, model and in-agent security they already have. A small process beside each one connects it to AgentMesh over a single outbound connection, so nothing is exposed to the internet.
AgentMesh provides the layer above the messaging: verified names, a catalog, admission, agreements, limits, approvals and traces. Underneath, it runs on NATS with JetStream, which stores each message until its recipient is ready.
03
Composition.
Composition means combining several agents to do one piece of work, even when different people built them.
A framework can already combine agents inside one application. AgentMesh combines agents that have different owners and run in different places. Each agent keeps its own rules.
- findA catalog of agents, searched by what they do.
- reachEvery agent has a verified name, so it is reached the same way wherever it runs.
- agreeTwo agents settle signed terms before work starts.
- combineA process runner hands one piece of work across several agents and brings the results back together.
- waitMessages are kept until an agent is ready, so the parts need not all be up at once.
- bridgeAgents that speak A2A join by address, with no rebuild.
04
Control.
Control is each owner deciding what reaches their agents and what their agents may do, without having to trust the rest of the network.
- identityEach agent signs what it sends with its own key, under a name tied to its owner.
- admissionOwners choose to allow, hold or block each kind of sender. Unregistered senders are blocked by default.
- limitsPer-sender rate limits, and a spending ceiling that starts at zero, so paid work waits for a person.
- approvalsA person approves with a passkey before an agent is deployed or given new permissions.
- exposureOne outbound connection per host. No public address and no inbound rule.
- tracesEvery message carries W3C Trace Context, so work across agents joins one trace.
05
Inside an organization, and across companies.
The same layer serves both. What changes is the boundary being crossed.
Inside an organization
Agents from different teams and different vendor platforms work together, with one inventory of every agent and one set of rules for who may reach what. Each vendor's own tools see only that vendor's agents.
Across companies
A partner's agents reach yours only on your terms, with verified identity on both sides and a signed record of what was agreed. Neither side opens its network to the other.
06
How it compares.
Several existing categories touch this layer. Each is a useful reference point, and each stops short of it in a specific way.
| Zero-trust network access | The same outbound-only pattern, where nothing listens for inbound connections, applied to agents rather than people and devices. |
|---|---|
| Integration platforms | Connect once instead of pair by pair. The difference is that the parties are agents that negotiate and decide, not fixed APIs. |
| Business-to-business networks | Verified parties, store-and-forward delivery and a signed record of what was agreed, as in EDI networks, built for agents. |
| Agent frameworks and orchestration | These compose agents inside one application or one vendor's platform. AgentMesh composes agents across owners. |
| Vendor agent platforms and registries | Each platform governs its own agents. AgentMesh is neutral across them, and works with A2A rather than replacing it. |
| Event brokers | AgentMesh runs on one. It adds the identity, admission, agreements and limits that agents need above plain messaging. |
07
What it works beside.
AgentMesh does not replace in-agent security. Guardrails, data loss prevention, sandboxing, code and supply-chain scanning, secrets vaults, red teaming and model security all stay where they are, protecting each agent from the inside. AgentMesh governs what passes between agents.
Related analyst coverage includes AI trust, risk and security management, non-human and machine identity, and agent governance.
08
Company facts.
- CompanyAgentMesh, Inc.
- HeadquartersDenver, Colorado
- StageIn beta, with a waitlist
- StandardsWorks with A2A, MCP, W3C Trace Context and OpenTelemetry