Cross-Principal Communication Between Agent Delegates

Agents increasingly act as delegates with access to their owners’ private information and tools. Communication across owners, or principals, enables cooperation but must respect constraints on disclosure and state changes, creating a security–utility trade-off. Studying that trade-off requires a framework in which communication policies and executable permissions are controlled together, and in which messages are connected to the resource access and state changes they cause. We formulate cross-principal delegate communication and introduce such a framework: SharedOS governs execution under explicit permissions, while SharedEval lets researchers define environment-specific tasks, authorization labels and outcome criteria reflecting owners’ expectations. We instantiate it with two datasets, bilateral PAIR and network NET. In PAIR, more explicit, relationship-aware policies reduce disclosure, their utility costs depend on requester entitlements, and requester relationships shape both disclosure and over-refusal. Re-asking a refused request under new framings almost never changes the delegate’s decision, although a multi-turn session exposes more of the protected material than a single request does. In NET the same ladder does not hold: the holder’s own relationship-aware document gives back more than the generic caution gained, because a forbidden edge is one fact inside a category that the same relationship permits. Together, our formulation, research infrastructure and empirical findings provide a foundation for studying cross-principal communication between agent delegates.