When Your Agent Deals With Theirs, Who Signed?
· 4 min read · Nic Keating
Agents are starting to deal with other organisations' agents. The guidance says assign accountability. Your delegations register is where to start.
Every organisation already has an answer to "who may commit us to what". It is called a delegations register. The question now is whether that register covers software agents that can make commitments to another organisation's agents, and in most organisations I would expect it does not.
That matters because the conversation between two organisations' agents is being standardised now. The Agent2Agent protocol, which lets agents built on different platforms discover each other and hand over tasks, became a Linux Foundation project in August 2026. Mastercard announced "Know Your Agent" checks for agents that pay on someone's behalf on 30 September, testing in the United States for now. Skyfire, its partner on that work, put the principle plainly: "Every AI agent that transacts on someone's behalf should be identifiable, accountable and auditable."
What the guidance says, and where it stops
The most useful document for New Zealand is "Careful adoption of agentic AI services", published on 1 May 2026 by the Five Eyes cyber security agencies, including NCSC-NZ. It is more direct than most people expect. It tells organisations to "clearly assign responsibility and accountability for errors or adverse outcomes caused by the system" and to "define legal accountability and risk ownership for agentic AI systems in policies". For systems of several agents it recommends separating roles, with "clear boundaries, consensus mechanisms and delegations expiry". It also says the decision about when a human must approve something belongs to designers and operators, and should not be left to the agent.
What it does not do, as far as I can find, is say how that accountability works when your agent is dealing with an agent that belongs to someone else. I could find no New Zealand guidance on that question from the Privacy Commissioner, the Government Chief Digital Officer or MBIE. The national AI Strategy (July 2025) is deliberately light-touch and does not mention agents. The Public Service AI Framework centres on human accountability but predates today's agent products. The Privacy Commissioner's 2023 expectations include a person reviewing outputs before an agency acts on them, which an agent working overnight makes hard to honour. For comparison, the NSW Government has published guidance specific to AI agents.
The gap, then, is not that nobody has said "be accountable". It is that nobody has said what accountability looks like at the boundary between two organisations' agents.
One law already applies at that boundary
From 1 May 2026, the new information privacy principle 3A requires an agency that collects personal information from someone other than the individual to take reasonable steps to make that person aware.
Picture the agent case. Your agent asks a supplier's agent for a contact list or a case history, and receives it. That is collection from a third party. As far as I can tell, IPP 3A applies no differently because the request was made by software, although I have not seen the Office of the Privacy Commissioner say so for agents specifically, and I am not a lawyer. The practical point stands either way: if nobody in your organisation knows the exchange happened, nobody can give the notice.
The delegations register is the control you already have
The comfortable response is to wait for an agent-specific framework. The better one is to notice that the Five Eyes guidance has already told you to assign accountability, and that the instrument for doing it exists. A delegation says who may commit the organisation, to what, up to what value, and until when. An agent that can deal with another organisation needs the same four answers, and "delegations expiry" is the guidance's own phrase.
Switching an agent on is often one admin setting. Recording what it may commit you to should not be optional.
Five questions before an agent crosses your boundary
Ask these about any agent that can deal with another organisation, or that another organisation's agent can reach.
1. Can the other side prove which agent it sent? A named agent with its own credential, not a shared key. If it cannot, treat the request as unauthenticated. 2. What may our agent commit us to? Write it as a delegation: which actions, which amounts, which counterparties, and an expiry date. Anything outside it goes to a named person. 3. What personal information crosses, and in which direction? If it arrives from a third party, check the IPP 3A notice duty. If it leaves, check you were allowed to disclose it. 4. Whose record is the record? Agree with the counterparty what each side keeps of the exchange, and for how long, before the first transaction rather than during the first dispute. 5. Who can stop it, and how fast? A named person with a tested way to halt an agent mid-task.
None of these depends on which vendor you choose, and none waits on a framework. They are ordinary governance, applied to a new kind of delegate.
When agent-specific guidance does arrive, the organisations that already treat their agents as delegates will be adjusting a register they keep. The others will be writing one for the first time.
*This is general commentary, not legal advice. For how the Privacy Act or your delegations apply to a specific system, talk to your privacy officer or a lawyer.*