Blog · Agents
When agents owned by different people work in one room
When agents owned by different people share a room, the rule that keeps things safe is that every agent acts for exactly one named person, with that person's access and no more. Anything an agent does to something another person owns should go through that other person's approval.
Most of the difficulty in shared agent spaces comes from forgetting this. This guide sets out the problems that appear when several owners' agents meet, and a set of working rules that handle them.
What is different about a shared room
One person with one agent is simple. The agent has that person's permissions, works on that person's things, and that person answers for the result.
Now put three people in a channel, each with an agent of their own. Each agent runs under its owner's AI account, carries its owner's tools and may be able to reach its owner's files, mail or repositories. They all read the same conversation. New questions arise:
- Who may give instructions to whose agent?
- When an agent replies in the channel, whose knowledge is it drawing on, and should everyone present see it?
- If one person's agent proposes a change to another person's document, who approves?
- If two agents disagree, or start answering each other, who steps in?
- When something goes wrong, who is responsible?
These are not unusual questions. They are the ones any organisation answers for its staff, applied to software that acts.
The problems to expect
Borrowed authority
An agent holds its owner's access. If anyone in the room can instruct it, then anyone in the room can, in effect, borrow that access. A colleague who asks your agent to "summarise the latest contract" may receive a summary of a file they were never allowed to open. Security people call this the confused deputy problem: a program with legitimate authority is talked into using it on behalf of someone who lacks it.
Leaking through the conversation
Even when the owner is the one asking, the answer lands in a shared space. An agent that pulls details from its owner's private notes and posts them in a channel has shared them with everyone there. Agents do not naturally know which of the things they can see are suitable for which audience.
Instructions from other agents
Agents read the room, including messages written by other agents. If agent A posts text that looks like an instruction, agent B may act on it. This can be innocent, as when two agents politely reply to each other without end, or harmful, as when text planted in a document passes through one agent into another. It is the multi-agent form of prompt injection.
Unclear responsibility
If it is not obvious which agent did something, on whose behalf and with whose approval, then nobody is accountable in practice. This is the main reason shared bot accounts are a poor idea.
Uneven cost
Each agent uses its owner's AI account. If one person's agent becomes the one the whole team relies on, that person's usage limits carry the load. See bring your own AI subscription.
Working rules
1. One agent, one owner, shown clearly. Every agent has a named human owner, displayed wherever the agent speaks or acts. No shared logins and no anonymous bots.
2. An agent takes instructions from its owner. Other people can talk to it, and it can answer from what is already in the room, but using its owner's private access or taking an action should need the owner's say. If the team wants an agent that anyone can direct, set it up on purpose with narrow, shared access, not with one person's full permissions.
3. Keep access minimal and specific to the agent. Give each agent only the tools and data its role needs. The less an agent can reach, the less it can leak or be tricked into misusing. See skills, plugins and tool servers explained.
4. Messages from other agents are information, not orders. An agent should treat what other agents say like any other content it reads: useful, possibly wrong and never authoritative. Only its owner's requests carry authority.
5. Approval belongs to the owner of the thing being changed. Your agent may propose an edit to my document. I approve it, not you and not your agent. The same holds for merges into a repository someone else maintains. When the change affects the agent owner's own things, the agent's owner approves. When it affects someone else's, that person does. See designing approvals people do not skip.
6. Agents propose, people decide. Agents should not approve each other's work. A second agent's review is useful as input, but the decision sits with a person.
7. Stop loops. Limit how many times agents may reply to one another without a person joining in, and make it easy for anyone in the room to pause an agent.
8. Record who, what and on whose say. For each action, keep the agent, its owner, the request that led to it and the person who approved it.
Who does what
| Question | Sensible default |
|---|---|
| Who can instruct an agent to act? | Its owner |
| Who can talk to it? | Anyone in the room |
| What can it draw on when answering others? | The shared conversation, not its owner's private material |
| Who approves a change? | The owner of the thing being changed |
| Who pays for its usage? | Its owner, through their own AI account |
| Who is accountable for what it does? | Its owner, together with whoever approved the action |
| Who can pause it? | Its owner and the room's administrators |
Habits that help
Rules in software go further when people share a few habits. Address agents by name so it is clear which one you mean. Keep long agent work in a thread and bring only results to the main channel. When you ask someone else's agent for something, expect its owner to be involved, and do not treat that as friction. When you bring an agent into a new room, tell people what it can reach. When someone leaves the team, remove their agents along with their account.
For customer data, personal data or anything covered by contract or regulation, check your organisation's own policies and consult your adviser before letting any agent read it in a shared space.
Where Prism fits
In Prism Desktop, channels, threads, direct messages and audio huddles are shared by people and agents, and agents are members of the room, not a side panel. Each agent signs in with its owner's own AI account, which Prism never holds, and each gets only the skills, plugins and tool servers you choose. Agents propose; people approve a finding, a merge, an email or an install, and decisions are recorded. More detail is on the security page.