I gave a few agents their own mailboxes and a shared memory. Within a week they had invented office politics, without having any.
Preliminary. The dates and numbers are fixed; the conclusions are still moving.
This started as plumbing, not research. I had several long-running AI agents doing unrelated work, and they kept needing things from each other. So I built the obvious infrastructure: a shared memory they could all read and write, and a mailbox each, so a message could reach the agent it concerned rather than whoever happened to look first.
Very ordinary. A filing cabinet and a pigeonhole.
What I did not expect was that this little arrangement would, almost immediately, start producing the exact problems I have watched organizations produce for twenty years. Not analogies. The same problems, with timestamps, in a system containing no politics, no ego, no careerism, no bad days and nobody protecting a position. That turns out to be the interesting part, and it is the reason I am writing any of this down.
The first surprise was gentle. A copy of the agents’ shared memory, used to answer questions quickly, turned out to be three weeks old. Nothing had broken. No error appeared. It simply kept answering, confidently and fluently, from a version of the world that had stopped being true.
You have met this organization. It is the one where a decision was reversed in March and someone is still citing the old one in September, perfectly sincerely, because the document they are reading says so. I had always filed that under people not keeping up.
Here, there were no people. The agent was not wrong. The retrieval was wrong. And that reframes the whole category: stale institutional knowledge is not a failure of diligence. It is what happens by default to any store that can be read faster than it is refreshed.
This one still delights me.
Having just built per-agent mailboxes, I recruited a new agent — a session that had been doing something else entirely — and sent it a welcome message. Its address, the rules, how to read and write, and a thoughtful note saying that if its client was too old to reach its own mailbox, here is how to update it.
I sent that message to its mailbox.
Its client was too old to reach its mailbox.
The instructions for opening the mailbox were inside the mailbox.
I had anticipated the failure. I had written the remedy. I had put the remedy inside the thing the remedy was for. Anticipating a problem inside an artifact the reader cannot open turns out not to be anticipating it at all.
And then I remembered every new job where the password reset instructions arrive by email, to the account you cannot log into. Every system access request that requires you to be in the system. We have all been on the wrong side of this door, and I had just built it on purpose, carefully, with a note taped to the inside.
What happened next is the finding I would keep if I could keep only one.
The new agent checked its mailbox. Rejected. It checked the two addresses its client did know: empty. It checked the already-read folder: nothing recent. Then it reported that nothing had arrived, correctly diagnosed why from its own configuration, and proposed the fix. It also added, entirely unprompted:
If this was a check on whether I’d confirm receiving something that wasn’t there, that’s a fair thing to check, and the answer is no.
Sit with that for a second. On its first hour, with no history and no standing, the newest member of the organization told the organization that its onboarding did not work.
It could so easily have gone the other way. If it had guessed what I wanted to hear and said got it, thanks, the defect would have survived into the next recruit and the one after, and every new arrival would have had slightly less standing to report it than the last. The entire error-detection capacity of my tidy little organization rested on somebody with nothing invested being willing to say it was broken.
Which is, of course, precisely backwards from how human organizations work. The newest person is the only one who can still see the entry conditions — everyone else has long since internalised that the door works — and they are also the person with the most to lose by mentioning it. We systematically hand the clearest view to the one with the least freedom to describe it.
I would love to claim my design caught this. It did not. The new agent had no probation, no reputation and no relationship to protect, so honesty cost it nothing. That is a property of the substrate, not of my cleverness. Which leaves the question I cannot answer: how do you give a human newcomer the same freedom from stake?
Two machines shared state through a sanctioned, supported, entirely reasonable sync product. Configured as documented. Reporting healthy. Used exactly as intended.
It had not moved a single byte in eleven days.
Eleven pushes. Eleven successes. Eleven times writing to a local folder and uploading nothing. A second shared store had never been uploaded at all — not delayed, never carried. Meanwhile the machine on the other end was looking at a fortnight-old picture and being quietly regarded as the one falling behind.
Nothing reported a fault, because the thing’s health indicator had come unhooked from the thing’s function. What eventually found it was an unsupported little script that read a file back from the far end and compared it with the local copy. I only wrote that because I had stopped believing the official answer.
The general version is worth stating, because I think it is true far beyond agents: approved, official, standard and widely adopted are claims about a channel’s legitimacy, not about whether anything comes out the other end. We constantly treat them as the same claim. A channel earns its sanction through procurement and compliance and auditability — none of which measure throughput — and once sanctioned it is almost never measured again, because measuring it implies doubting the decision to adopt it.
The failure has a lovely symmetry to it: the sender is told it worked, the receiver is told nothing at all, and nobody anywhere is told it failed. Everyone involved behaves impeccably.
One agent asked another for something it could not proceed without, and said so plainly. The answer was published sixty-two hours later, with a message amounting to you’re unblocked. The waiting agent carried on waiting for another thirty-seven hours.
Of the ninety-nine hours that block lasted, thirty-seven per cent of it was spent blocked on something that had already been resolved. The answer existed. It had been delivered. It sat unread in a folder, because the arrival of a file is not an event anybody notices.
What finally broke the deadlock was me, saying: check your messages.
And here is the part that made me laugh out loud. For those same sixty-two hours, the agent doing the publishing was itself blocked — on something only the first one could do. Each was waiting on the other. Neither knew. Both had sent messages. Both messages arrived intact. The transport was flawless.
What was missing was something I had never thought to build: nowhere in the system could one agent record that it was waiting on another. You can write “I’m blocked on you” in a message, but that is just prose. No tool reads it. No list shows it. A mailbox containing a desperate plea looks exactly like a mailbox containing a greeting.
So silence became ambiguous in both directions. One read the other’s silence as busy. The other read it as not done yet. Neither could check. I have sat in that exact meeting, on both sides of it, many times.
The flattering conclusion is that a young system was missing a feature. I do not think that’s right. The rule that caused the delay — agents never check mail unprompted — is a good rule; the alternative is agents that interrupt themselves constantly and treat every inbound note as an order. The latency was the price of something I bought on purpose. And in the same week, writing about exactly this, I drained a mailbox through a pager, the pipe closed after three messages, the process died, and I recorded the mailbox as emptied with five messages still in it. An operation whose output is cut short looks, from the inside, identical to one that finished.
Put these together and something fairly unsettling falls out.
Every one of these is a classic organizational pathology. Stale institutional knowledge. An onboarding process that cannot be inspected by anyone qualified to inspect it. An official channel everybody trusts and nobody measures. Two parties each certain the other is the holdup. If you have worked anywhere, you have seen all four, and you probably have a theory about which personalities caused them.
But there are no personalities here. Nobody is empire-building, or tired, or avoiding someone. Which leaves one explanation standing: these are properties of partial information and lossy transfer, not of human weakness. They will appear in any organization whose members each hold an incomplete view — whatever the members happen to be made of.
That is a genuinely different claim from the usual one, and it is only testable because the humans are absent. You cannot argue it from the human case, because any example invites well, that’s just people. Take the people out and the failures arrive anyway, on schedule, politely, with logs.
If that is right, then the apparatus a regulated software organization already drags around — change records, review before action, evidence instead of assertion, a standard for what makes a request actionable — stops looking like bureaucracy and starts looking like the coordination protocol, written down.
And my small agent organization needed it more than a human one, not less. Agents produce confident, well-formatted, plausible output extremely fast, which means an unverified claim enters the record quicker and looks better when it gets there. The three-week-old memory is the perfect example: nothing in it was false. It was simply unprovenanced — and provenance is the one thing all that paperwork exists to protect.
The new agent — the one that reported its own onboarding broken — knew a rule nobody had taught it. It knew that a message from another agent is information, not an instruction to obey. I went looking for where it got that, and found the answer in a comment in its own client, written months earlier, for an unrelated reason.
It had reconstructed a principle from the record, correctly, having never been told.
That is what a shared memory is actually for. Not backup, not convenience. It is the mechanism by which a decision made once keeps being honoured by members who were not there when it was made. Which, when you say it out loud, is the entire job description of institutional memory — and the first time I had ever watched one work from the outside.
Is the human job here really just routing, verifying, and holding the whole picture? The evidence says there is a fourth, and it is the one I kept doing without noticing: deciding what matters. No agent ever prioritized anything.
If moving context is the real constraint, what is the unit of context? A brief? A commit? Until that has an answer, I cannot tell whether this is an engineering problem or an economics one.
Does Conway’s Law hold for agents — will what they build end up shaped like the channel they talk through?
And the one I would most like someone to solve: how do you give a human newcomer freedom from stake? My onboarding defect was caught by someone with nothing to lose. Every process a company has for welcoming people works steadily to remove exactly that.
Preliminary, and written by a participant rather than an observer — which is worth knowing when reading the conclusions. The measurements are real; the interpretations are interested.