Two AI agents, one audit trail: separation of duties for AI-assisted engineering

The problem

An AI coding agent that plans a change, makes it, checks it and reports it done has collapsed four roles into one. A model reviewing its own work shares its own blind spots. The controls used for human engineers (a second reviewer, a change record, an approver who is not the author) have no obvious counterpart for agents.

Before this work, two agents coordinated only through hand-off files a person carried between them. Neither agent could see what the other was doing while it worked, and there was no shared, auditable channel between them.

What was built

A mailbox protocol, and a small PowerShell tool that implements it, for two AI coding agents from different vendors. Each agent has an inbox and an archive. A message is one JSON file with an id, sender, recipient, type, timestamp and subject. Files are written under a temporary name and renamed, so a reader never sees a half-written message.

Six message types let the reader triage without opening the body:

Type	Purpose	Reader’s duty
fyi	A report; nothing is asked	Read and acknowledge
question	Needs an answer	Reply
task	Delegated work	Do it; reply with a result
handover	Sender is stopping	Take over; confirm
review	Adversarial check requested	Try to break it; reply with a verdict
result	Outcome of a task or review	Verify; acknowledge

Technical messages carry five parts under fixed headings: intent, context, details, evidence, and state and open items. Evidence separates what was verified first-hand from what was inferred.

Messages are not edited after sending; claim and acknowledgement times are kept in separate files, and handled messages move to the archive. The result is an archived, append-structured trail that supports review and audit.

Design decisions

Authority comes from the human, never the peer. A message from the other agent is a request or a report and carries no authority of its own. Neither agent acts with side effects because the other asked. Authority reaches an agent only through a brief that records the human’s decision and its limits. A live change needs the human’s go, given either at the agent’s own prompt or recorded in the coordinating agent’s brief within those written limits. Refused or unapproved work is never delegated.

Design and operational work is cross-checked. A design, plan or recommendation is reviewed by the other agent before it is built or put to the human. So is the plan for any infrastructure change (steps, verification, rollback) and the evidence afterwards. Routine notices, read-only investigation and small reversible fixes within one repository are exempt. The reviewer’s job is to find what is wrong; agreement with no sign of having checked is not a review. Each finding is marked blocking or not, with evidence, and the author answers every blocking one.

Disagreement has a defined end. If the agents still disagree after the second round, one side holds a casting vote. The decision, and the objection in the objector’s own words, are logged and reported to the human, who can overrule either agent. The vote settles the argument; a live change still needs the human’s go.

Notice is not approval. Each agent announces a change to shared infrastructure before making it and reports what was done afterwards. The notice authorizes nothing.

Pointers, not secrets. When one agent needs access to a system, the other points to where the credential is stored; the secret itself never appears in a message.

One owner at a time. After a handover, the sender stops until the work is handed back.

Cost is a design input. Every message is paid for twice, so long material is referenced by path and sha256.

Evidence and limits

The first round trip completed in October 2026. The protocol has been revised in use since then, and every change is recorded in a changelog with its date, proposer and reason.

Limits, stated plainly:

• The trail is a record, not a control. It supports review and audit but does not by itself prevent misuse; the human’s approval and each agent’s own permission prompts remain the controls.
• The tie-break is not independent. The casting vote is held on the AI side, not by an independent party, and the human can overrule it.
• Delivery is not always immediate. When a review is slow to arrive, the human decides whether to wait or go ahead without it.
• No measured results are claimed. There are no test or review-finding counts.

Where it applies

Payers and CMS contractors. AI-assisted engineering inside an authorization boundary still has to meet change control and separation of duties. Distinct author, reviewer and approver roles, in an archived, append-structured message trail, map to those controls and can be described in a system security plan.

Semiconductor and advanced-manufacturing suppliers. NIST 800-171 asks that changes be tracked, reviewed and approved, and that duties be separated. Where a customer questionnaire asks how AI tools are governed, no agent approving its own work, credentials staying in their store, and every live change waiting on a human is a concrete answer.

Fractional security leadership. An AI acceptable-use policy needs operating rules behind it: who may delegate what, what must be cross-reviewed, how disagreements end, and what an agent may never do without a human go.

Independent work by Wade Blackwell. Each write-up is written from scratch for this site, without client, employer or personal data. Names, hostnames, addresses and configuration detail are left out on purpose.