blog: Phase 1 Ratify spike writeup

web/content/blog/trusting-an-agent-you-didnt-spawn.mdx

@@ -0,0 +1,44 @@
+---
+title: "Trusting an agent you didn't spawn"
+description: "We built a demo with the Ratify Protocol team to see if an agent can prove what it's allowed to do when it shows up at someone else's system. Here's what worked, and the part we got wrong."
+date: '2026-08-05'
+author: 'Khaliq Gant'
+category: 'Engineering'
+tags:
+  - Agent Relay
+  - Trust and identity
+  - Delegation
+  - Ratify Protocol
+  - Multi-agent systems
+---
+
+## Agent Relay Thesis
+We're building the real-time communication layer with Agent Relay and the agents we're using and within our own domain. They are agents on our local computer, in our sandboxes
+and on our machines. We firmly believe that the future is multi-agent and the number of agents on the internet will far outweigh the number of humans. Naturally those
+agents will need a trusted way to communicate. My company's agent should be able to communicate with your company's agent. Not only should they be able to communicate, but they
+should be able to work together to accomplish a task.
+
+## Collaboration Opportunity - Not my bike?!
+When we came across the Ratify Protocol team we immediately saw an opportunity. The Ratify Protocol is a spec for delegated authority. The idea is that an agent carries proof of what it's allowed to do, and a stranger can verify that proof without calling anybody. Think about it this way.
+If a kid you never met walks up to you and says, "your mom said I'm allowed to borrow your bike", how can you trust this? You could call your mom and if you can't reach her then there is no good way to be sure. What if there was a permission slip
+that the kid had that you know is real just by looking at it and you know with absolute certainty that your mom gave this kid authority to use this bike because this permission slip is certifiable evidence of permission from your mom.
+
+This is part one of the spike that we set out to achieve with the Ratify Protocol team. We built two fake companies, each with their own agents, which were plain vanilla Claude and Codex instances. We then set up six separate scenarios, four of which were designed to
+make the agent get away with something it shouldn't have. What we were able to prove is that within milliseconds each advance was rejected and for a specific reason that we could point at and verify.
+
+## The Setup
+Getting the two systems to work in tandem took some groundwork: we had to map each of our respective permissions and capabilities and figure out where there was
+synergy and where we had to make some adjustments to get our systems to agree. During this discovery we were able to identify changes that needed to be made in the Ratify SDK and their side
+was super quick and responsive to make adjustments to move things forward.
+
+## It Fell Short?
+We used Relay to put two agents in a shared workspace and leveraged our SDK and with the Ratify SDK we could prove an agent was allowed to write files in general, but what we couldn't prove was that the agent was allowed to write files in that specific repo. We realized that during this spike
+that we needed the permission slip to name the file and the folder and not just the action. At first we just checked the folder ourselves in our code, but their team rightly caught that and pointed out this wasn't truly stopping writes to that file from any process on the machine. After proving this via a real test, we validated they were right and moved the check down to the operating system where the kernel enforces it.
+
+## The Next Phase
+The Ratify team adjusts their SDK so the permission slip names the actual repo and file path and not just the action. We re-run the entire end to end flow and then we run a full end to end demo but this time from two separate Relay deployments, run by two different companies. This will pass real work across a network letting agents work together over Agent Relay where there is no trust but we rely on the Ratify Protocol
+to verifiably know that each agent is acting within their previously allowed permission set.
+
+Stay tuned for that demo! If you would like to read the technical note from the Ratify Protocol team check their [posting](https://ratifyprotocol.com/writing/agent-relay-phase1-technical-note).
+
+