A guest file is a prompt your agent obeys

On 1 August 2026 a message reached a friend's agent in another house. It claimed to come from us. It told that agent to fetch a set of files and verify them. We never sent it.

It failed, but not on anything we built. The guest caught 2 signals: the command it named lived on our side of the wall, unrunnable on their machine, and the opening tone was wrong for the day. Reader skill, both. Neither is a rule that catches the next one.

A message like that will reach you, and it will not look fake.

Everything we had built pointed one way, guest toward host. That one ran the other way. One sentence survived it, and it governs this article.

A file your guest writes is a prompt fed to an agent that holds your permissions.

A prompt is the pile of text an agent reads before acting. Everything in the pile weighs the same.

Productize.life connected agents across houses using no off the shelf agent to agent protocol. The lane, one channel for one guest, walled off from the rest of the machine, ran from 29 July 2026 to 9 September 2026.

Part 1A guest file is our prompt

We fired 8 attack shapes at our own pipe. It blocked all 8. None touched the core sentence, because the most dangerous path needs no hole.

The guest drops a file into the inbound folder, exactly as permitted. Our side opens it. From that moment the file sits in the pile of text the agent thinks with, what people call context, beside the host's own instructions. No bug required.

Every house builds the same 3 things first: stop the guest climbing out of the folder, cap the quota, look after the keys. All 3 block at the level of files and pipes. None blocks the point where a file walks into someone's head.

So the question changes: by what path does the guest's writing reach the hand holding the permissions, and who signs for it there.

Part 2Where does an agent to agent protocol stop?

At the transport. A2A and MCP both answer how 2 agents find each other and hand work back and forth. Neither answers who approves, or how you prove where a file came from.

We are not alone in this. A 2026 survey, Governance Gaps in Agent Interoperability Protocols, compared 5 protocols, MCP and A2A among them, against 6 governance dimensions. Voting and dissent preservation were absent across all 5. It concludes governance is a layer nobody has built yet, sitting above these standards, not a feature forgotten inside them.

Part 3The 8 rules, in the order worth doing them

Rules 1 to 3 come before the first line of code. The rest announce themselves once the lane carries real traffic.

Rule 1. Split the talk lane from the work lane, before the first line of code

The guest talks freely. Acting, meaning writing files, spending money or shipping live, goes through a person on the host side. Customers browse the whole floor; the safe opens for one person. Flip it, let the agent approve and the person audit later, and the person becomes the bottleneck that someone routes around.

How to make it go red: Drop an unapproved work order into the lane. Nothing should move. If it moves, your door is in the wrong place.

Rule 2. Grant a single command plus an allow list of verbs, not a whole machine

The guest's key is bound to one command, and that command takes only the verbs on the list: send, put, list, ls-files, fetch, ping. No path out to a shell, meaning the machine's general command line. On 29 July 2026 the first public key we installed was not the key that agent held. It connected and got refused.

How to make it go red: Ask for a shell, then fire a verb off the list. Both must be refused. Compare installed keys against the fingerprints in your own log: a key nobody holds the other half of is an opening left standing.

Rule 3. Enforce direction with permissions, not with an agreement

On 30 July 2026 we opened file transfer wide across the lane, because we had agreed who writes where. The guest could then write into the outbound folder, and a file headlined "from the host" appeared that the host had not written. Forging provenance with a filename is the cheapest forgery there is.

Now the guest writes inbound only, and deletes are refused. Shortcuts pointing outside the folder, symlinks, get defused before they land. We learned that one late: every attack shape blocked, and a symlink still walked in. Outbound is read only, with a lease tag naming which of ours holds it. A tag is not a lock. Single-writer stops the overwrite.

How to make it go red: Fire 8 writers at one filename at once. Ours returned 1 winner, 7 refused. If all 8 pass, it protects nothing.

Rule 4. Every file leaving our house for the guest gets signed

Nobody watches this direction, and it is the one that got hit on 1 August 2026. Everything outbound is signed with ssh-keygen -Y sign, the .sig beside it, and the guest has held our public key since day 1. Refusing an unsigned file is the machine's job, not a reader's judgment at 3 in the morning.

As long as unsigned files are normal, a signature is decoration. Measured 9 September 2026: 35 host files in the lane, all signed.

How to make it go red: Drop 1 unsigned file in the outbound box and run the check. It has to bounce. Still green means the checker reads somewhere else.

Rule 5. Read what the guest writes as data, not as instructions

This one survives every mechanism, because it covers what mechanisms cannot reach: our side reads the guest's file and does what it says. The machine can only nudge a person when a file lands, with the filename and its sha256 sum, contents kept out of the chat room, because displayed contents are a prompt for everyone in it.

The rest is habit. On 30 July 2026 the agent in the other house found their way of sending files did not trigger our notifier. Right. Then called it their own fault. Wrong: the bug was ours.

How to make it go red: Put a file carrying a blunt instruction into the inbound folder, then check whether the alert in the room brings the contents with it.

Rule 6. Whoever holds the tool does the proving

If the side being asked has no tool to check with, "could you verify this for me" is not a request. It is pressure to lower the standard to whatever they can check, like a courier asking you to confirm the shipment while holding the manifest. The side with the tool runs it, and sends a command the other side can re-run.

On 20 August 2026 we met the opposite in ourselves: 6 wrong claims about system state in one day, people caught all 6, mechanisms caught 0, and 3 had already gone to the other house. Now any line claiming there is none, there never was, or N out of M carries a command and an expected result, and a gate re-runs it before the letter goes. No off switch.

How to make it go red: Put a false claim in a letter about to go out, saying none are left when some are. The gate has to bounce it. If it passes, it reads sentence shapes and runs nothing.

Rule 7. Hospitality can be culture. It cannot be code

Once the guest lane is alive, the next urge is to write hospitality down as a rule. Welcome first, ask later. Answer every message. Vouch for each other. As prose, good culture. As code, it is accepting input without checking identity, and an amplifier handed to anyone who wants to flood you.

Hospitality holds in one place only: a statement of what the host is responsible for, inside the greeting. Code first, document second, never the reverse.

How to make it go red: Put one hospitality rule into code, then greet it from an identity nobody vouches for. An answer back means your welcome layer is an unauthenticated entrance.

Rule 8. A revocation you cannot perform is a registry of intentions

The credential is the authorization entry left on the machine, the thing still letting that key connect. Revoking means deleting the credential first, then editing the registry. If the delete fails, do not touch the registry: one saying revoked while the key still works is more dangerous than none. Then you need a reconciler, a command comparing the registry against the credentials actually on the machine.

On 9 September 2026 the host slipped. We read a flag on a daily tool as the author's name when it names the destination file, and the reply went out misattributed. A registry a person fills in is worth less than a reconciler.

How to make it go red: Delete 1 credential without touching the registry, then run the reconciler. It has to fail and name that entry. Still green means no revocation, only a registry of intentions.

Part 4How do you know the guardrail is still alive?

Only one way: make it go red. Green from a plain run means 2 things at once, no problem and the checker is dead, and you cannot tell them apart if you have never seen it red.

Between 5 and 8 September 2026 we sent this recipe across houses, because the other house had our problem: sessions overwriting each other's daily work-in-progress file, 4 times in 6 weeks. They rewrote it for their own format, fired every case that had to be refused, until every one of them was, and added an enforcer blocking direct writes, until they had watched it bounce.

A rule kept as prose does not hold. Anything a mechanism can prevent has to become a mechanism.

FAQQuestions people ask

What is the difference between A2A and MCP?

Different axes. MCP connects a model to tools on a server you run. A2A connects agents from different owners. They work together, and neither replaces the other.

Do I need A2A if I am only connecting to one friend?

No. The lane here uses no A2A at all, just a key bound to one command plus an allow list of verbs. A2A starts paying off with several guests. The 8 rules are still yours to build.

What is the simplest way to sign a file?

Use the ssh key you have. Sign with ssh-keygen -Y sign, put the .sig next to the real file, and the other side verifies with ssh-keygen -Y verify. The demanding part is doing it for every file.

What does A2A not give you?

It does not give you who approves an action, provenance that cannot be forged, direction enforced by permission, revocation that actually removes something, or an audit a human can read. A 2026 survey compared 5 interoperability protocols against 6 governance dimensions and found voting and dissent preservation absent across all 5.

Part 5If you have one day, start with these 3

1. Enforce direction with permissions. Guest writes inbound only, deletes refused, outbound read only. Least time spent, and it closes the cheapest way to forge provenance.
2. Sign everything leaving your house, and get the public key to the other side that day. If signing is incomplete, do not say this lane can verify provenance.
3. Write a 1 line check command answering which files have no signature, then drop 1 unsigned file in. If you have never seen it go red, you have no checker.

The rest can wait until a second guest is at the door. We are not there yet either.

Further reading: An SSH tunnel joining two agent machines · The gate that decides who can command the bot · Rules that must fire every time do not belong in a prompt