The Third Protocol

It is eleven at night and there is an agent three files into a refactor on my Mac, and I am not there.

I want to be precise about what that sentence means, because it describes something that did not exist a few years ago. The machine is not running a job I queued. It is not compiling, or syncing, or backing up. It is making decisions. It read the failing test, formed a theory about the cause, opened a file I did not tell it to open, and is now rewriting a function while I stand in my kitchen. If its theory is wrong, it will notice, back up, and try another. Nobody is watching it do this.

The strange part is not the capability. The strange part is the feeling, which I can only describe as the feeling of work continuing without you. Anyone who has managed people knows a version of it. You leave the office and things keep happening. But an employee going on without you is a person, with judgment you have calibrated over years and a stake in not burning the place down. What is running on my Mac right now is an extremely capable process with no stake in anything. It will do exactly what it believes I asked, at full speed, for as long as I let it.

So the question that actually matters at eleven at night is not "can the agent do the work." That one is settled and it gets more settled every month. The question is: who is in command, and through what?

1The asymmetry

Here is the shape of the last few years, reduced to one line: agent capability scaled like compute, and human attention scaled like nothing at all, because attention does not scale.

Every serious person running coding agents feels this asymmetry daily. One agent became three. Three became a fleet with different briefs and budgets. The models got better at going longer without help, which sounds like relief and is actually the opposite. The longer an agent can run unsupervised, the more that happens between the moments you look. Capability compounding against a fixed supply of attention is not a productivity story. It is a supervision crisis arriving in slow motion, and it is arriving politely, one convenient release at a time.

Now look at what we built to support all this, because the pattern is telling.

We built a protocol that connects agents to tools. MCP gives an agent hands: files, databases, browsers, APIs. It is good and necessary work, and it made agents dramatically more useful.

We are building protocols that connect agents to each other. The A2A family lets autonomous workers delegate, coordinate, and negotiate among themselves. Also necessary. Fleets need plumbing.

Count the parties served. Tools: served. Agents: served. The person who is answerable for what the agents do — the one whose name is on the commit, the deploy, the customer email, the bill — has no protocol. The human is the only party in the entire system whose connection to it remains improvised: a terminal window you happen to have open, on a machine you happen to be sitting at.

Both existing protocol families exist to make agents more capable. Nothing existed to keep a person in command of that capability. That is the gap, and it is not a feature gap. It is a structural omission, and it becomes more dangerous exactly as fast as the other two protocols succeed.

2What command actually means

"Human in the loop" has become a phrase people say to end conversations rather than begin them. So it is worth being concrete about what being in command of an agent actually requires. It reduces to three verbs.

See. You cannot command what you cannot observe. And observation has a fidelity requirement: summaries are not enough, because summaries are produced by the thing being supervised. Command needs the structured transcript for speed and the raw terminal for ground truth, because when something is wrong, the polished view is precisely the view you stop trusting.

Say. Command means input. The next instruction, the answer to the question the agent asked, the approval it is waiting on. Not "input eventually, from the desk." Input when the agent needs it, from wherever you are, because the agent's clock does not pause for your location.

Stop. The most important verb, and the one that only matters if it is fast. An interrupt that lands after the wrong migration ran is a postmortem, not a control. Being in command means the distance between "I see it going wrong" and "it stopped" is measured in seconds.

Three verbs. And then one adverb that carries the entire weight of the thing: scoped.

A person who can see, say, and stop through a channel that can also read their email, browse their disk, and open arbitrary ports has not built a control layer. They have built a second, bigger problem. The channel of command must be able to reach exactly the session surface it was granted and nothing else, and that boundary cannot be a promise in a privacy policy. It has to be enforced in code, in a place the user can point to.

This is why the word is control and not communication. Agent-to-agent protocols are communication: peers exchanging messages. What the human needs is not a peer relationship with the agents. The human is not another node in the swarm. The human is the party the swarm answers to.

So name the layer for what it does. MCP connects agents to tools. A2A connects agents to each other. The third protocol connects agents to you: scoped visibility, scoped input, scoped interrupts, enforced rather than promised. Call it what it is — an Agent Control Protocol.

3The human in the loop has a body

There is an assumption buried in almost every discussion of AI oversight, so old that nobody says it out loud: the assumption that supervision happens at a desk.

Every safety framework that imagines a human approving an agent's action quietly imagines that human seated in front of the machine, badge in, terminal open. That picture was fine when the work only happened while you watched. It collapses the moment the work continues without you, because people are not seated. People cook, commute, pick up their kids, lie awake at midnight, walk. The human in the loop has a body, and the body moves.

For a while, we handled this the way people always handle a new constraint: we didn't. You stayed at the desk longer. You checked before bed. You accepted that a running agent meant a tethered human, the way a boiling pot means someone in the kitchen. This works at the hobby scale and fails at exactly the moment the technology becomes worth supervising, which is the moment it runs long.

Here is the claim I have become certain of, and I want to state it plainly because I think it will read as obvious within a few years: as agents become more capable and more numerous, people will not accept being tethered to a physical machine to remain in command of them. Not because untethering is a nice convenience, but because tethered oversight does not survive the scale-up arithmetically. If supervision requires the desk, then supervision ends when you stand up, and everything after that moment runs unsupervised by definition. The only oversight that survives agents working around the clock is oversight that lives where attention actually lives, which for every person reading this is a device in a pocket.

This is not a prediction about phones. It is a prediction about the loop. Either the human's command channel travels with the human, or the human quietly exits the loop while everyone keeps saying the phrase.

And the channel traveling with you changes what supervision feels like, in a way that matters more than it sounds. Oversight stops being a place you go and becomes a thing that reaches you. The agent finishes a turn: your wrist taps. An approval blocks a worker: your Lock Screen says so, with enough context to decide. Something looks wrong: you open the raw terminal from a parking lot, see the truth, and stop it. Attention becomes a resource the system routes to where it is needed, instead of a room you sit in.

4Receipts

There is a second half to command that the three verbs do not cover, and it is the half that institutions will care about first: proof.

Oversight that cannot be audited is theater. If a person approved an agent's action, then somewhere there should be a record that survives the moment: who approved what, when, from where, on which device. Not as surveillance of the person — as the person's own evidence. The approval is a decision a human made; the record is that decision, kept.

Call these receipts. Every consequential human act in the loop — approve, deny, interrupt, escalate a model, widen a permission — becomes a signed, timestamped fact. Done properly, on modern hardware, a receipt can carry proof that a genuine device with a genuine person behind it issued it: hardware-attested human presence, not a script that says "yes" on a timer.

Notice what receipts do to the standard anxiety about AI in serious organizations. The anxiety is not really "the agent might do something wrong." Everything might do something wrong; that is why process exists. The anxiety is "we would not be able to show who allowed it." Receipts answer the actual question. They convert "a human was in the loop" from an assertion in a slide deck into a queryable trail. And they do it without surveilling the developer, because the trail records the developer's authority, not their behavior.

Individuals want receipts for a humbler reason: memory. What did I approve last night at 1am? On which Mac? For which worker? A supervision tool that cannot answer this is asking you to trust your own recollection of your most tired decisions.

The deep point is that receipts are what make the whole untethering trustworthy. Command from anywhere is only acceptable, to you and to any institution above you, if command from anywhere leaves the same quality of evidence as command from the desk. The pocket has to be at least as accountable as the chair.

5The perimeter as a stance

Everything above is architecture. This last part is a stance, and it is the part I care about most.

If you build the third protocol, you are building the most sensitive channel in the whole system: the one that carries a person's authority. The temptation, and the industry default, is to route that channel through yourself. Host the relay, store the transcripts, own the account, sit in the middle. Every incentive of modern software pulls toward the middle.

I think the command layer is the one place where sitting in the middle is disqualifying. The channel that carries your authority over your agents, working on your code, on your machine, should not deposit any of it with a third party by default. Local-first is usually argued as a feature. For a control layer it is closer to an ethical requirement: the person in command should be the only party who accumulates the record of command.

And the boundary of the channel should be public. Not "we take security seriously" — the actual list. Every path the phone can reach on the paired machine, published, and enforced by the same code that ships. A perimeter you can read is a different kind of promise than a perimeter you are assured of. It converts trust from a mood into a document. If the list ever grows, the diff is visible, and the burden of explaining it falls where it belongs, on the people who grew it.

This is a stance about who agents answer to, finally. Agents answer to someone. The protocols that give them hands and peers are how they work. The protocol that binds them to a person is why the whole thing remains something a person is doing — why the work, at the end of the chain of delegation, still has a name attached that belongs to a human being who could see it, steer it, stop it, and prove they were there.

6The ordinary future

Let me end with how this looks when it is boring, because every important layer of computing ends up boring.

A few years from now, somebody starts four agents on a codebase before lunch: different briefs, different budgets, one of them on a cloud box rather than the machine on the desk, because "the machine" stopped mattering once the route was private and the surface was scoped. They spend the afternoon out. The wrist taps twice. One tap is a completed turn, glanced at and dismissed. One is an approval: a worker wants to run the deploy checklist. They read the context on the Lock Screen, look at one diff on the phone, approve it with their thumb, and the receipt files itself away with the when and the where and the device attached.

In the evening they skim the day the way you skim anything mature: by exception. Nothing needed them for hours at a stretch, and when something did, it found them in seconds. At no point did they wonder what the agents could reach, because the answer is written down. At no point did they wonder whether stepping away meant giving up command, because command stopped being a place a long time ago.

None of this will feel like the future when it arrives. It will feel like the obvious way to work with things that work while you don't. The agents will be smarter than anything we currently run, and mostly that will be fine, because the oldest requirement will still be met, quietly, by a layer with an unglamorous name: the work answers to a person, and the person can always reach the work.

That is the third protocol. The first two made agents capable. This one keeps them yours.

Pairling is one implementation of this idea: an Agent Control Protocol with its perimeter published, carried over a WireGuard-encrypted route that runs inside the app, with no account and no hosted transcript store. The essay stands either way.