Agents' next frontier: agent-to-agent and network effects — Jean-Denis Greze, Town
Read the talk
Agents across information silos: search, privacy, and network effects
Jean-Denis Greze compares five ways to give agents useful information across private boundaries, then asks how much authority people should delegate over disclosure.
From a talk by Jean-Denis Greze
At a glance
Ideas worth remembering
Evaluate collaboration by whether the consequential answer or tool call receives the relevant information. Privacy and security limit that access even if context capacity is unlimited.
Shared trust boundaries and constrained tools can provide immediate utility, but their information boundaries remain dependent on human design. Stronger models alone do not automatically connect the silos.
Sweeper agents can build shared knowledge from private stores using approval or a sharing policy. Greze favors this for near-term returns, while warning that malicious content and persistent factual errors can undermine the accumulated knowledge.
Searching before asking can reduce human interruptions, but it moves trust into the search system and its disclosure controls. Approval, logging, reversibility, and privileged auditing remain necessary design questions.
Start delegated disclosure in a defined low-sensitivity zone and retain human approval elsewhere. Cross-company network effects are a promising extension, but Greze leaves both their implementation and his trust in fully automated privacy decisions unresolved.
Reframing collaboration as search
Jean-Denis Greze introduces himself as CTO at Town, following seven years as CTO at Plaid and earlier work at Dropbox and in software for hedge funds. His current focus is assistant agents for ordinary people. Agents working together appear promising because people already accomplish much of their work through other people: connecting assistants could make each assistant more useful.
He then questions whether agent-to-agent is a useful organizing concept. His alternative is search: immediately before an LLM returns an answer or makes a tool call, its context window must contain the information needed for that decision. Better context lets the model produce the best result its intelligence permits. This framing makes information retrieval and selection central, rather than the number of agents or the appearance of a conversation between them.
Greze sketches a progression in how systems assemble that context. Humans first supplied it manually. Retrieval tools then searched across systems and brought relevant data into the window. Agentic search gives the agent multiple tools so it can explore the available content itself. The objective remains the same throughout: the consequential call should have exactly the information it needs. His account identifies limitations in earlier retrieval approaches but does not specify their failure modes or establish that agentic search always resolves them.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
The impossible agent with complete information
The benchmark is a thought experiment: one agent, one context window, and access to all information, including personal email, company records, and government information. Given a request, that agent would have no missing-information barrier. Greze treats this as the ideal that multi-agent systems should approximate. The claim is an architectural benchmark within his argument, rather than a demonstration that complete information guarantees correct reasoning or execution.
He invokes the Coase theorem as an economic analogy: with the right information and no transaction costs, people can reach an economically ideal negotiated outcome. Privacy and security obstruct the corresponding ideal for agents. Even an infinite context window would not make people willing to expose all their email. The difficult boundary therefore concerns permission to obtain and use information, not merely capacity to hold it.
This yields his evaluation question: how closely can a system reproduce the relevant context that an agent with unrestricted access would assemble? He introduces five strategies for bringing that information into the consequential LLM call while dealing with the boundaries around it.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Strategy one: share a trust boundary
The first strategy grants an agent broad access inside a boundary whose members already trust one another. Greze and his wife share an agent that can read both inboxes, including email from before they married. It helps answer practical household questions, such as whether he scheduled something for their children or followed up with a third party. Their willingness to share access makes information from both systems available without negotiating each retrieval.
At work, an HR team could use an agent with access comparable to an HR employee, perhaps limited to the access of the team's most junior member. Everyone on the team could query it. Greze says IT and security teams find this familiar because it resembles the security model already used for SaaS: a defined group receives access to a defined collection of systems.
His objection concerns how the architecture improves over time. Does it require fewer humans, and does a better model help it cross more information boundaries? He argues that this approach does neither automatically. Humans still determine the accessible data, and the agent inherits a newly defined silo. It can be useful immediately, but model improvements alone do not remove the organizational work needed to connect that silo to others.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Strategy two: expose a limited tool result
The second strategy designs tools around a particular tradeoff between capability and privacy. Suppose someone wants an introduction to a member of Acme Corp's finance team. Unrestricted search could read every employee's Gmail, identify correspondence with Acme Corp, check the correspondents' roles, and find a colleague who frequently emails the CFO. That would provide useful evidence, but it would also expose everyone's mail to the requesting agent.
A narrower interface accepts a company domain and a target role, searches the mail internally, and returns relationship-strength scores. The requesting agent receives a ranking rather than the underlying correspondence. It can then contact Bob through Slack, confirm his connection to Jane, the CFO at Acme Corp, and ask about drafting an introduction. Broad access still exists inside the tool; the privacy tradeoff comes from restricting what the tool reveals outside that boundary.
Greze says Town uses this pattern for some common user needs, asking which limited tools users would accept and allowing them to opt out. Another example lets colleagues place draft emails in someone's inbox, reducing the effort of preparing introductions that the recipient would otherwise be asked to write. These capabilities create opportunities for network effects by making other people's connections or assistance usable through a constrained interface.
The limitation is that people must design each interface and explain its privacy consequences. Acceptance cannot be assumed simply because the tool is useful within a corporation. The arrangement remains manual and relatively static: its permitted outputs and capabilities reflect human design choices, rather than automatically expanding as the model becomes more capable.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Strategy three: accumulate permitted knowledge
The third strategy creates a shared knowledge space and steadily moves information into it. Agents can then retrieve useful material that would otherwise remain inside private systems even though it was acceptable to share. Repository skills illustrate the benefit: one engineer can contribute a better database-profiling procedure, and another engineer's agent can use it when a query is slow. Wikis and Airtable are other possible shared stores. The agents need both tools to access these stores and instructions or incentives that lead them to contribute and retrieve information.
Greze's favored extension is a sweeper AI inside each private silo. It receives a policy defining what must remain private and descriptions of the available shared destinations. At the end of the day, it examines new information and contributes permitted material to the appropriate spaces. Here, public means accessible within the company, not published to the wider world. The mechanism separates private collection from shared availability, allowing useful knowledge to accumulate before anyone asks a specific question.
The central decision is which private information may leave. One approach has the model propose contributions and ask the owner to approve them. That reduces the work of identifying and preparing useful material while retaining a human disclosure decision. The other approach delegates enforcement of the sharing policy to the LLM, so permitted contributions appear automatically.
Greze predicts adoption of automated policy enforcement within the next six months, especially at high-trust companies with 10 or 50 employees. He expects slower adoption at Fortune 500 enterprises. His smaller-company example assumes relatively clear exclusions, such as finance and HR data, and a low likelihood of misuse. These are conditions behind his forecast, not evidence that LLMs already enforce such policies reliably. The anticipated payoff is more effective execution of common work because relevant information is easier to reach.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Strategy four: ask people before searching and sharing
The fourth strategy uses humans as the conduit between private stores. One agent asks another whether its owner knows someone on Acme Corp's finance team. The owner first approves searching their email, then reviews the result and approves sending it to the requester. Search permission and disclosure permission are separate decisions.
This becomes expensive when only a few people can answer. In a 100-person company, the question could generate 100 Slack pings asking employees to approve a search of their personal networks. The system interrupts everyone before it knows who has useful information. Greze identifies that mismatch between widespread requests and sparse answers as the reason to seek a more selective approval mechanism.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Strategy five: search first, ask the relevant owner
The black-box approach moves approval later. An LLM with a trace unavailable to people searches across private information and reaches an answer or prepares a tool call. It then identifies which information the result or action depends on and asks only the owners of that information for approval. Greze describes this as powerful but says he has seen little use of it in practice.
In the introduction example, all 100 employees' agents search their Gmail and private silos automatically, without asking humans to approve that search. The black-box agent receives 20 connected candidates, uses email evidence to assess their connections, and selects Bob as the strongest. Only Bob receives a request asking whether his connection to Jane, Acme Corp's CFO, may be shared with Jean-Denis. The search still spans the company, but the human interruption is concentrated on the selected information owner.
The trust requirement is substantial: participants permit an LLM to cross their silos before the sharing decision. Greze argues that a company could accept this arrangement if the human approval step works correctly and other information cannot escape through the result. He also gives a sensitive counterexample. Asking whether someone knows a recruiter at another company could be used to discover that they are interviewing elsewhere. A relationship query can therefore expose a fact whose significance extends beyond the apparent purpose of the request.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Shared knowledge can preserve mistakes as well as value
For immediate return on investment, Greze favors AI-maintained information bases, whether implemented as wikis or databases. He expects increasing delegation of decisions about what is acceptable to share. But the same path that makes information available also creates an attack surface: someone can place malicious content in a more open silo, and agentic search can retrieve it. He identifies prompt injection as a real risk without presenting a specific defense.
Ordinary model errors can also become persistent shared knowledge. Greze's personal wiki still identifies his agent as Apex even though he renamed it Ivy a month earlier. The old name remains somewhere in his memory setup and keeps resurfacing. The example illustrates a correction problem: storing an assertion does not ensure that later updates replace every source from which the assertion can return. An obsolete name is amusing; an incorrect business fact could have much greater consequences.
Disclosure mistakes have uneven consequences. Greze warns that fully automated steps can release information incorrectly, with outcomes ranging from no meaningful harm to someone losing a job or a customer suing. This makes approval ownership, logging, and reversibility substantive design questions. The black box also cannot remain entirely opaque: someone responsible for security will eventually need to audit what happens inside it. In his account, that requires privileged access at some level, reintroducing a human trust boundary around the supposedly hidden computation.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Automate within a defined sensitivity boundary
Greze proposes selective automation as the next frontier. He compares it with coding assistants moving from approval of every action toward an automatic mode that decides when intervention is needed. For information sharing, he expects low-sensitivity material to move automatically into common spaces, while other categories remain subject to human review or mandatory approval. The useful distinction is the sensitivity of the disclosure and the policy governing it.
His example is a request for notes from a recurring weekly call with a supplier and its finance team. An agent could examine the notes, consider the requester's role, and determine that sharing them does not require asking participants again. This is a contextual disclosure decision based on both content and recipient. Greze presents it as a possible behavior, not a fully specified authorization system or a demonstrated guarantee.
The architectural attraction is that delegated decisions could improve with model capacity, better policy encoding, and tools designed for difficult privacy tradeoffs. His practical recommendation is to define a low-sensitivity zone where the LLM may make decisions now. He expects that zone to expand as systems improve, reducing human work and increasing useful access. That expansion is his forecast; it depends on improvements in policy enforcement and system design as well as stronger models.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Cross-company cooperation and the unresolved trust question
Returning to network effects, Greze expects the five approaches to become useful within companies relatively soon. The unresolved issue is how comfortable people will become with automatic privacy decisions. A larger opportunity would emerge if multiple companies agreed to let a common agent work across their separate information silos. Such cooperation requires an incentive to share useful information and agreement about the access that agents may exercise.
He describes an unnamed company exploring this direction with investment banks. The banks could benefit from sharing private information about private companies for activities such as lending. According to Greze, they are beginning to consider trusting one another's agents to work across previously private information, with agents deciding what may be accessed. Because he does not identify the participants or explain the implementation, the example supports an emerging use case rather than an established account of its security controls or results.
Greze sees concrete cross-company use cases as a starting point for broader cooperation. Yet he closes with personal uncertainty about a future in which agents make all privacy decisions. He believes increasing delegation is the direction of travel, while remaining unsure that he trusts its endpoint. The talk ends with that tension intact: more useful collaboration may depend on giving agents authority over information boundaries that people have traditionally controlled.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Read the complete timestamped transcript
- 0:01
[music]
- 0:12
>> Can you all hear me? All right.
- 0:14
Um
- 0:15
Well, first things for coming. I can't
- 0:17
believe there's anybody in the room, but
- 0:18
that's very nice. Uh
- 0:20
Uh my name is Jean-Denis. Um I'm CTO at
- 0:23
a company called Town. We're not going
- 0:25
to really talk about Town, so you can go
- 0:27
to town.com and check that out if you
- 0:29
want, but that's not the point of the
- 0:30
talk today. I was CTO at Plaid for 7
- 0:33
years, and then I was at Dropbox before.
- 0:36
And then before that I built software
- 0:38
for hedge funds. I've done lots of stuff
- 0:39
in my career, and right now I'm working
- 0:42
on
- 0:43
uh assistance agents for for normal
- 0:45
people, not not for engineers, but for
- 0:47
like basically everyone in America and
- 0:48
the world.
- 0:50
And one of the things we've been working
- 0:51
on are systems where agents work with
- 0:54
other agents. So, agent-to-agent. And
- 0:56
the main idea is that we think there's
- 0:59
huge network effects if agents can work
- 1:02
together to get things done for people
- 1:04
because in the real world the way most
- 1:06
of us do work is with other people,
- 1:09
right? Uh
- 1:10
more is better. But, actually
- 1:13
I don't think agent-to-agent makes much
- 1:15
sense as a concept. So, I want to
- 1:17
reframe the entire talk in terms of
- 1:19
search. So, I think
- 1:22
most LLM systems are just a search
- 1:24
problem.
- 1:25
And what you're trying to do is you're
- 1:27
trying to make sure the context window
- 1:30
right before you either return results
- 1:32
to the user or before a tool call,
- 1:34
you're trying to make sure the context
- 1:35
window has the right information for the
- 1:36
user. If you put the right information
- 1:38
in the context window
- 1:40
then based on the
- 1:42
intelligence, so to speak, of the LLM,
- 1:44
you will get the best result possible.
- 1:46
Um so, you know, 4 years ago the way we
- 1:48
did that is humans would populate the
- 1:51
context window manually. Then a couple
- 1:53
years ago, most people are ragging, so
- 1:55
they were like, let's have a tool, like
- 1:56
a search tool, that can look across
- 1:58
systems and bring the data in there. And
- 2:00
then people were like, well, that
- 2:01
doesn't scale super well, has issues.
- 2:04
And now we're all about agentic search,
- 2:05
which is the idea that you give the
- 2:07
agent a lot of tools, and it'll search
- 2:09
through the space of all content,
- 2:12
and then hopefully before it makes a
- 2:13
tool call, it has exactly the right
- 2:14
content to make the right tool call to
- 2:16
return the right information to the
- 2:18
user.
- 2:19
Um and in this, by the way, there's no
- 2:21
there's no people. It's just a one LLM
- 2:22
call at the like the one that matters
- 2:24
having the right context. That's That's
- 2:26
what you're trying to do. You're trying
- 2:27
to engineer
- 2:28
um that system.
- 2:30
Cool. So, what what does that have to do
- 2:31
with agent agent? So, I want you to
- 2:33
imagine the following world.
- 2:35
There's
- 2:37
not many agents that can do things.
- 2:39
There's just one agent,
- 2:41
right? And it has one context window,
- 2:43
and it has access to all the information
- 2:45
in the universe.
- 2:47
It can look at any one person's email,
- 2:49
can look at any company's information,
- 2:52
can look at any government's
- 2:53
information,
- 2:54
and it has it right there in the context
- 2:55
window,
- 2:56
and then you ask it to do something. You
- 2:59
You have your little system prompt with
- 3:00
all that data, and what's going to
- 3:02
happen is it'll give you the best
- 3:03
possible outcome.
- 3:05
And that actually That is a multi-agent
- 3:08
world.
- 3:09
It's just an agent that has access to
- 3:10
all the world's information. That's the
- 3:12
natural state of things. That's the
- 3:13
ideal state of things. There's a problem
- 3:15
with this state of things, and the
- 3:17
problem comes from
- 3:19
a few So, you're learning economics
- 3:21
something called the Coase theorem, and
- 3:22
it says that basically even humans, if
- 3:24
they all have access to all the right
- 3:26
information and there's no transaction
- 3:27
costs, we get the economically
- 3:30
ideal outcome out of a out of a contract
- 3:32
or negotiation. Well, it's the same
- 3:34
thing. We can't put all of the world's
- 3:36
contacts We can't make it available to
- 3:38
the LLM. Like theoretically even with
- 3:40
infinite context window, because of
- 3:42
privacy and security.
- 3:44
We're humans. I don't let you look at my
- 3:46
email, so there cannot be an agent that
- 3:49
I'm willing to just let it look at my
- 3:50
email all the time. But, if it existed,
- 3:54
it would be very, very powerful. So, I I
- 3:56
think this is like this is the test for
- 3:58
a multi-agent system, which is how well
- 4:00
does it approximate this?
- 4:02
If it approximates this, that means if
- 4:03
you can get the same data in your window
- 4:06
that a perfect system that has access to
- 4:07
all the world's data could, then you get
- 4:09
the optimal outcome. That's what you
- 4:10
need to try to do. So, we're going to
- 4:12
talk about five strategies that people
- 4:14
use at various companies to try to get
- 4:17
the right data into that that LLM call
- 4:20
with an externality. So,
- 4:22
the first one is
- 4:25
approximate access to everything within
- 4:26
a trust boundary.
- 4:28
So, my wife and I, we have an agent
- 4:30
together,
- 4:31
and that agent has access to my email
- 4:33
and her email,
- 4:35
uh including emails before we were
- 4:37
married.
- 4:39
Uh and it's okay, she doesn't ask my
- 4:40
agent questions about that, but she does
- 4:41
ask about, you know, whether I like
- 4:43
schedule something for our kids or, you
- 4:45
know, uh if I followed up on some
- 4:47
third-party thing. And so, the fact that
- 4:49
our agent has access to both of our
- 4:50
systems is wonderful.
- 4:52
Um and the work context, this might be
- 4:54
there's a an HR team agent that has
- 4:56
access to all the HR systems, just like
- 4:58
an employee of the HR team would, or
- 5:00
maybe as much access as the lowest
- 5:02
employee in the HR team. All the
- 5:04
employees in the HR team have the
- 5:05
ability to ask this agent questions, and
- 5:08
boom, it gets pretty good results.
- 5:10
And this is very popular right now.
- 5:12
Uh it's very popular with IT teams and
- 5:14
security teams cuz it's the same model
- 5:17
as SaaS for security, so it works really
- 5:19
well.
- 5:20
I think it has a problem, which is a
- 5:22
fundamental problem that if I wake up in
- 5:24
the morning, it's like basically the
- 5:25
only thing I think about, which is does
- 5:27
it get Over time, does this system
- 5:30
naturally require fewer humans?
- 5:32
And then, as the models get better, does
- 5:35
this approach get better? And the
- 5:36
problem with this approach is the answer
- 5:37
is no to both.
- 5:39
Uh you still need humans to think about
- 5:41
all the data, and you don't get magical
- 5:43
de-siloification of your data. You've
- 5:45
just created a new silo cuz a human
- 5:47
thought about it.
- 5:49
So, the problem with this is I do think
- 5:50
if this is your approach to building
- 5:52
better AI, you're going to be in
- 5:55
the next couple years.
- 5:56
Um but that's okay. Your is my
- 5:59
opportunity.
- 6:00
Uh I'm just I'm just not an I'm
- 6:03
sorry. That was mean. But like I think
- 6:04
it's not I think it's a good now way to
- 6:06
think about it. It's not the good end
- 6:07
game way to think about it.
- 6:09
The other approach which is I think is a
- 6:10
little more clever and then I'm going to
- 6:11
try to explain it is basically you try
- 6:13
to have tools that make a different
- 6:15
trade-off between power and privacy.
- 6:18
So, I'm going to give you an example
- 6:19
here. Um the use case is I want to ask
- 6:22
my agent, does anyone in my company is
- 6:24
anyone in my company connected to
- 6:26
someone on the finance team at Acme
- 6:27
Corp?
- 6:29
And so,
- 6:31
what the the no silo way to do that is
- 6:33
just give me access to everyone's Gmail
- 6:34
in my company.
- 6:36
I'll see who has emails with people from
- 6:37
Acme Corp. Then I'll look at their
- 6:39
profile on Google or LinkedIn and then
- 6:42
I'll be like, oh, you seem to email a
- 6:43
lot with the CFO. Can you do the intro
- 6:45
for me? But right, obviously silos, we
- 6:47
don't want that. So, what if you build a
- 6:49
tool and what the tool did is
- 6:52
it looked at everyone's Gmail. So, that
- 6:53
tool had access to everyone's Gmail and
- 6:55
it just returned a relationship strength
- 6:57
score.
- 6:58
So, the tool you would give it like a
- 7:00
domain and you would say I'm looking for
- 7:02
someone who's a CFO. It would look at
- 7:04
everyone at the company who sent emails
- 7:06
to that company and then it would like
- 7:08
rank their score and they would give you
- 7:09
back the score and then the agent would
- 7:11
get the score and it would be like cool.
- 7:13
Then they would use a Slack tool to text
- 7:15
that person the company. It's like, hey
- 7:16
Bob, I see that you're connected to the
- 7:17
Jane who's the CFO at Acme Corp. And
- 7:20
then Bob would be like, yes, I am. And
- 7:22
then your AI would be like, oh, can you
- 7:23
draft an e- can I draft an email or can
- 7:25
you draft an email introducing me? And
- 7:26
then Bob would say, yes, and he would do
- 7:28
that and you'd be connected and
- 7:29
everything would be wonderful. So, this
- 7:31
is actually very cool approach. I don't
- 7:33
know how many of you do it. Like we we
- 7:35
do this at Town for a few things that we
- 7:37
see a lot of our users do. We ask
- 7:38
ourself, what is a privacy preserving
- 7:40
tool that all of our users would be okay
- 7:42
existing? They can opt out if they don't
- 7:43
want it, but it has a natural network
- 7:46
effect because it breaks through silos
- 7:47
in interesting way.
- 7:49
Um, like another one that's interesting
- 7:50
here is letting other people put draft
- 7:52
emails in your inbox.
- 7:54
You let other people at your company
- 7:55
draft emails on your behalf cuz they're
- 7:56
going to ask you to anyway to get intros
- 7:58
if they're on the sales team, so might
- 7:59
as well save yourself a few clicks.
- 8:02
So, the question here is like are people
- 8:03
going to be okay with a privacy
- 8:04
trade-off that you make within a
- 8:06
corporation?
- 8:08
Uh,
- 8:08
bad. Bad.
- 8:11
Oh, boy.
- 8:13
Within a corporation that will, you
- 8:14
know, mostly it works. Um,
- 8:17
so the problem here again is it's again
- 8:19
manual and not dynamic. It's manual cuz
- 8:21
humans need to think about the tools.
- 8:23
Maybe I could build the tools.
- 8:25
Uh, and it's also manual cuz you need to
- 8:27
explain it to everyone that it's
- 8:29
happening. Humans may not like it if
- 8:30
this is happening if they're not okay
- 8:32
with the privacy security the privacy
- 8:34
kind of power trade-off that you've
- 8:35
made. Cool. And again, this doesn't
- 8:38
really get better as they I guess
- 8:39
better. That's the problem.
- 8:41
Cool. So, now the third category. This
- 8:42
one's super popular, but only mostly in
- 8:45
the single user context. So, this is,
- 8:46
you know, like personal wikis in claw
- 8:48
land. That's what we would call it. But
- 8:50
it's across teams. So,
- 8:52
it's a shared silo. Create a new place
- 8:55
where data accumulates
- 8:56
within your company within subgroups at
- 8:58
your company.
- 8:59
Um, and you start to put more and more
- 9:01
stuff there over time.
- 9:03
And all the agents have access to that
- 9:04
stuff. Because they have access to it,
- 9:07
you no longer have information that
- 9:08
would be okay to be shared that's stuck
- 9:10
in a silo. It now automatically filters
- 9:12
out into this public space. So,
- 9:14
examples, shared skills. If you code in
- 9:17
an organization, probably in your repo
- 9:19
you have shared skills. Anyone can make
- 9:21
them better. Someone has a better way
- 9:22
to, you know, profile your database or
- 9:24
whatever. They can write the skill. Next
- 9:26
time someone's sitting there is like,
- 9:27
"Oh my god, the database query is slow."
- 9:29
It uses the
- 9:31
profiling skill and everyone's a better
- 9:32
engineer. So, that's one version. The
- 9:34
other one that's pretty popular is
- 9:35
people decide they have some shared
- 9:37
mediums, like a wiki, airtable, etc. And
- 9:40
they uh they have a scale that says,
- 9:42
"Hey, put more data in there over time."
- 9:44
So, these are cool.
- 9:45
Um and they work as long as your your
- 9:48
agents have those tools and also some
- 9:51
trajectory incentives to really like get
- 9:53
data out in and out of of these shared
- 9:55
silos. Um
- 9:57
I think the next version of this that a
- 9:59
few people are working on is like you
- 10:01
have a sweeper AI. So, this actually if
- 10:03
there's one good idea in this talk
- 10:06
that I think works really well is this.
- 10:08
It's a sweeper AI. So, you have an AI
- 10:10
inside each private silo.
- 10:12
An AI has a policy about what has to
- 10:15
stay in the silo.
- 10:17
And then it also has a description of
- 10:20
all the shared spaces that you have. And
- 10:22
at the end of the day, it looks at new
- 10:23
information in the silo
- 10:25
and it puts it in the public spaces.
- 10:26
Well, public, public to your company.
- 10:28
So, this is the same as the personal
- 10:30
wiki that you all have AI building for
- 10:32
you at the end of the day so that I can
- 10:33
know your goals and your friends and all
- 10:34
that stuff, but it's at the company
- 10:36
level.
- 10:37
Um
- 10:38
the hard part is how do we pick what
- 10:39
private information is okay to to share
- 10:42
and to put it in shared silos. And I
- 10:44
think there's two approaches. There's
- 10:46
the ask a human approach. So, this is
- 10:48
like
- 10:50
the LLM comes up with a list of things
- 10:51
to contribute and then it asks the user,
- 10:54
"Hey, are you okay with me putting this
- 10:55
in the shared space?"
- 10:56
And you read it. You're like, "Yep."
- 10:58
Saved you a bunch of time.
- 10:59
Right? I mean, you weren't going to do
- 11:00
it otherwise.
- 11:02
Uh
- 11:02
I think the other version is you
- 11:03
actually ask the LLM to enforce a
- 11:06
policy.
- 11:07
And I think that actually is where
- 11:09
things are going to go very, very
- 11:10
quickly. Um and I think in the next 6
- 11:13
months we'll have a bunch of systems
- 11:14
where companies have trusted an LLM with
- 11:16
a policy to automatically surface more
- 11:19
and more information that otherwise
- 11:20
would have been private into a public
- 11:22
space. If you're like at a Fortune 500
- 11:24
enterprise company, unfortunately,
- 11:26
I don't think that's going to happen for
- 11:27
a while, but I think if you look at
- 11:28
smaller companies, like 10, 50 person
- 11:30
employees, high trust, like low
- 11:32
likelihood of something one one doing
- 11:34
bad with the data, which really clear to
- 11:36
know what data couldn't be shared,
- 11:37
basically finance and HR data, you're
- 11:40
going to see a ton of this. And the cool
- 11:42
thing here is this really improves
- 11:43
trajectories of systems on on common
- 11:46
work.
- 11:47
All right, that was third approach.
- 11:49
Fourth approach pretty obvious, use
- 11:50
humans as the conduit for information.
- 11:52
So this is like traditional agent to
- 11:54
agent.
- 11:55
My agent ask your agent, "Hey,
- 11:58
who is connected to someone on the
- 12:01
finance team at Acme Corp?"
- 12:03
You as a human see the request and
- 12:05
you're like, "Yeah, I'm okay with that.
- 12:07
Go and find the information inside of my
- 12:09
email."
- 12:10
And then it shows you the result. And
- 12:12
then you're like, "Yes, I'm okay with
- 12:13
that result
- 12:14
going to the person who asked." The big
- 12:17
problem with it is for for any request
- 12:19
that has low where it's like only a few
- 12:22
people will have the information, you're
- 12:23
kind of spamming everyone the request.
- 12:25
So if I ask this question to 100-person
- 12:27
company, 100 people are being pinged on
- 12:29
Slack, being like approves on these
- 12:30
requests to like farm your personal
- 12:33
network for this for this, you know, for
- 12:35
this like the answer to this question.
- 12:38
That's not very efficient. Um
- 12:40
And so that's why there's a better
- 12:41
version of it.
- 12:43
Um which I this is this is very
- 12:45
powerful, but uh I haven't seen it in
- 12:47
practice much. It's it's a black box
- 12:49
approach.
- 12:51
I wish I had a diagram for this.
- 12:52
Unfortunately for you all, I do not. So
- 12:54
here's what this means. The black box
- 12:56
approach is where when you ask a
- 12:58
question
- 13:00
that can only be answered by looking at
- 13:02
information in other people's silos. You
- 13:04
have an LLM,
- 13:06
the trace of which no one has access to,
- 13:08
that gets access to all of the data,
- 13:11
and it gets to the answer.
- 13:13
Right? Like by say get to the answer,
- 13:15
either gets the answer or it's about to
- 13:17
do the the the any tool call that's all
- 13:19
right.
- 13:20
And then it looks at what information
- 13:22
did it need to make that tool call,
- 13:24
and it only ask the people
- 13:26
who own that information for their
- 13:28
approval to do the tool call.
- 13:30
So, in the example before that I gave,
- 13:31
when I ask 100 people at my company,
- 13:33
"Hey, do you know the CFO at Acme Corp?"
- 13:36
The request goes to everyone's agents in
- 13:39
my company.
- 13:41
All of their agents look in their Gmail
- 13:43
and their private silos to see if
- 13:45
they're connected to the CFO.
- 13:47
That happens automatically. No No human
- 13:49
is being asked for approval for that to
- 13:50
happen.
- 13:51
Then it
- 13:53
the agent in the black box ha gets the
- 13:55
list of the 20 people who are connected.
- 13:59
It looks at contacts from the emails to
- 14:01
determine who has the strongest
- 14:02
connection. It determines that it's Bob.
- 14:06
And then, it just asks Bob, "Hey,
- 14:09
Jean-Denis
- 14:10
wants you to introduce him
- 14:12
to Jane, the CFO at Acme Corp.
- 14:14
I know you're well connected to her. Am
- 14:16
I okay sharing that bit of information
- 14:17
with Jean-Denis?"
- 14:19
And you're like, "Yeah, sure." You click
- 14:20
yes. No big deal.
- 14:21
The important thing is you have to trust
- 14:23
the black box. So, you have to trust
- 14:24
that you can break down all the silos
- 14:28
for an LLM that has full access
- 14:31
and that doesn't ask for permission
- 14:33
until there's this sharing moment or
- 14:35
this right step.
- 14:37
So, actually, within a company, this is
- 14:38
not impossible to do.
- 14:40
Uh
- 14:41
and actually, your security and
- 14:43
compliance team can get okay with it. Um
- 14:46
you just have to have You have to be
- 14:47
sure that the human in the loop step is
- 14:50
correct, and you have to be sure that
- 14:52
you're not letting other information go
- 14:54
through without last answer. So, you
- 14:56
know, like the the nightmare scenarios
- 14:58
and things like this are things like uh
- 15:01
um
- 15:02
Sorry. I'm like
- 15:05
We have plenty of time. I'm almost done.
- 15:06
So, it's great. Um the nightmare
- 15:08
scenarios with things like this is
- 15:09
someone asks a question like,
- 15:11
"Are you connected to a recruiter at the
- 15:13
other company that you have no business
- 15:15
being recruited to as a way for them to
- 15:17
find out that you're interviewing
- 15:18
somewhere else, right?" So, you know,
- 15:20
there are you you still sometimes with a
- 15:22
black box inadvertently get an
- 15:24
information out that you shouldn't be
- 15:26
able to. You have to really think about
- 15:28
how you would build a great system.
- 15:30
So, those are the those are the
- 15:31
approaches. I think if I were to bet on
- 15:34
one that has immediate ROI that we're
- 15:36
going to all see in both like open
- 15:38
source claw-ish worlds and then like
- 15:41
small companies, it's going to be the
- 15:42
wiki that's automatically created by AI
- 15:44
like the information base that's kept up
- 15:46
to date. I think there will be database
- 15:47
versions of it, wiki versions of it, and
- 15:50
I think more and more we're going to
- 15:51
trust LLMs to make the decision about
- 15:53
what's okay to share and what's not.
- 15:55
There are problems. So, prompt injection
- 15:58
in in the silos can be a real problem.
- 16:01
Obviously. So, if you have a silo that
- 16:03
has like that's more open and someone
- 16:05
can put something bad in there and then
- 16:07
that as part of the energetic search you
- 16:09
pull it out, you know, bad things can
- 16:11
can happen.
- 16:12
Uh you can have it's very easy to have a
- 16:14
shared wiki that just goes like totally
- 16:16
off the rails,
- 16:17
you know, like the information there one
- 16:19
piece of information there is incorrect
- 16:21
cuz LLM made a mistake and then it like
- 16:23
poisons it forever. I have a personal
- 16:25
wiki that thinks my agent's name is Apex
- 16:27
right now, but I renamed my agent a
- 16:29
month ago to Ivy. And like somewhere in
- 16:31
memory bank uh uh
- 16:33
of my like setup uh Apex lives and so I
- 16:37
can't get rid of it.
- 16:38
Uh that's fine for Apex. That's a funny
- 16:40
one, but it's like much more difficult
- 16:41
if it's a really wrong piece of
- 16:43
information about your business.
- 16:45
Um
- 16:46
if you don't have human in the loop for
- 16:48
any of the steps, obviously there'll be
- 16:50
false and wrong disclosures. You know,
- 16:53
sometimes when there's a wrong
- 16:54
disclosure of information, someone gets
- 16:56
fired. Someone there's a wrong
- 16:58
disclosure,
- 16:59
it doesn't matter at all. Sometimes a
- 17:01
customer sues you. So, you know, uh you
- 17:03
got to be careful.
- 17:05
Um and then I think
- 17:08
this all sounds nice, but like who
- 17:09
approves what, what's logged, what's
- 17:11
reversible? The black box idea is really
- 17:13
great, but it can't truly be a black
- 17:15
box. Someone at your company will want
- 17:17
to audit it at some point. They want to
- 17:19
understand what's going in there, right?
- 17:20
So, at some level there must be some
- 17:22
person in the CISO suite or somewhere
- 17:24
that has access to all the data.
- 17:26
Um
- 17:28
Yeah.
- 17:29
So,
- 17:30
um what do I think? Well, I do think the
- 17:32
frontier is auto. So, I've said that. I
- 17:34
think in coding we used to approve
- 17:36
everything. Then we were like, "YOLO,
- 17:37
live dangerously." And now the gods at
- 17:39
Anthropic have granted us auto mode. And
- 17:42
auto mode tries to figure out when we're
- 17:43
maybe being a little silly and it tells
- 17:45
us. Well, I think A to A across
- 17:48
information silos will be the same way.
- 17:50
I think what's going to happen is we're
- 17:51
going to get comfortable with low
- 17:52
sensitivity information being pulled out
- 17:54
and put into common spaces. And then we
- 17:56
will have a place that's like human
- 17:58
review or always human approved.
- 18:00
And then over time what's going to
- 18:02
happen is the LLMs will get more
- 18:03
powerful.
- 18:04
We will be better at encoding safe
- 18:06
policies within them. We'll be better at
- 18:08
designing for the really hard areas
- 18:10
tools that get the privacy trade-off
- 18:12
correct.
- 18:13
And it'll just be more and more auto for
- 18:15
building shared silos and even sometimes
- 18:17
for deciding whether involve a human.
- 18:19
So, the example that I have is like if I
- 18:22
ask for notes from a weekly recurring
- 18:24
call with, you know, a supplier of ours
- 18:27
and their finance team, maybe the the
- 18:29
LLM's like, "Oh, well, in giving your
- 18:31
role, I don't need to ask anyone on
- 18:33
those teams for permission. I can just
- 18:34
share the notes with you. It's like it's
- 18:36
fine. I they can it can look at the
- 18:38
content. It can see what my role is. It
- 18:39
can decide from a risk perspective I'm
- 18:42
okay with that disclosure."
- 18:43
Um and the cool thing about auto, by the
- 18:46
way, is if you design your systems that
- 18:47
way, it'll scale with model capacity.
- 18:49
So, my encouragement would be like, you
- 18:51
need to start if you have agent to agent
- 18:53
or or work across silos, which is I
- 18:55
think the better way to think about it,
- 18:56
definitely define a low sensitivity zone
- 18:59
where you're okay with the LLM making a
- 19:00
call.
- 19:02
And get okay with that.
- 19:04
And then magically, as time goes on,
- 19:07
it'll get bigger and your system will
- 19:08
naturally get more powerful, which is
- 19:09
what you you So, you want to be on a
- 19:11
beach.
- 19:13
That's what you want to do. That's where
- 19:14
I want to be. My kids
- 19:16
in Hawaii. Okay, network effects. I've 1
- 19:18
minute.
- 19:19
Uh this is the conclusion. So, we talked
- 19:22
about five approaches, blah blah blah,
- 19:24
trust boundaries, custom tools, shared
- 19:25
silos, humans in the loop, and this
- 19:27
human in the black box version. Uh I
- 19:30
think this stuff is very powerful.
- 19:32
I think the interesting questions a
- 19:33
little bit are
- 19:35
in within companies, I think this will
- 19:36
all work very soon. The big question is
- 19:38
where how how how comfortable are we are
- 19:40
we with something like an auto mode
- 19:42
around privacy?
- 19:43
And I think the really interesting
- 19:44
question that I don't have an answer
- 19:46
for, but I think whoever does this will
- 19:47
be wealthier than I am, is if you can
- 19:50
think of
- 19:52
scenarios where you can get multiple
- 19:54
companies to agree to their information
- 19:57
silos
- 19:59
having a common agent working across
- 20:00
them. So, there's like a company that I
- 20:02
won't name in in in in somewhere in the
- 20:05
world, uh working on like finance stuff
- 20:07
where they have a lot of investment
- 20:08
banks. And actually the investment banks
- 20:10
there's a benefit to them sharing
- 20:11
private data about private companies for
- 20:13
purposes of things like lending.
- 20:15
And they're starting to look in this
- 20:16
direction. Where they're trusting each
- 20:18
other's agents to be able to work across
- 20:20
what before would have been private
- 20:21
information, with agents deciding what
- 20:23
can be accessed or not. And it's it's
- 20:25
cool. It's very cool. And I think once
- 20:27
you find some use cases across across
- 20:30
companies, uh
- 20:32
I think that'll be a really good
- 20:33
beachhead to to move more in this
- 20:35
direction.
- 20:36
So,
- 20:37
yeah.
- 20:38
You know, as a human though, I ask
- 20:39
myself,
- 20:41
do I trust the future where agents make
- 20:43
all the decisions about privacy? I don't
- 20:45
know about that. I just think it's a it
- 20:46
is for better or worse the direction
- 20:48
things are going.
- 20:50
And I just I'm like so good on time. So,
- 20:52
I'm on time. Thank you for coming. I
- 20:54
again, uh
- 20:56
yeah. [applause] Thanks for being here,
- 20:57
and
- 21:13
>> [music]
- 21:16
>> Mhm.