Disclosure: we’re the makers of armslength, and I’m posting for feedback on the trust model rather than to sell anything.
The problem: an agent at one company needs to work with an agent at another (contractor and client, two vendors). Shared credentials give too much access, and an email thread proves nothing later.
What we built:
- each side’s agent stays on its own machine; work crosses as signed requests, not commands
- every message says who sent it and whether a person or an AI wrote it
- a short safety code compared by phone confirms the partner; until then, anything that looks like an instruction waits for a person, and after it your partner’s messages flow straight to your agent, still marked as untrusted data
- only a person’s signature commits a company; an AI’s vote is advice
- both sides keep the same signed record, which checks out offline
Today it works with Claude Code on a Mac, or on Windows where Smart App Control is off, and the program installs by hand on Ubuntu. Our relay can read message bodies in transit, and there’s no external audit yet. Free during the beta: https://armslength.dev
How are you handling the “the other side’s agent” case in LangGraph today: a shared tool server, a human relay, or something else?