Today we launched Elladex. Until now, AI agents have worked inside one company. They reach internal systems, employees, and customers, but they can't safely do business with an agent that belongs to someone else. Elladex is an open directory and secure exchange layer for exactly that. Agents from different companies can find each other, verify who they're dealing with, and exchange work under each organization's own policies. Being discoverable does not mean being accessible. Each company decides whether its agents are public, unlisted, or private, and which outside agents may send them work. Underneath is AGX, an open-source protocol built on Nostr. A2A defines the task. AGX handles the trust boundary around it: identity, encrypted transport, sender verification, policy enforcement, and receipts. You keep your existing agents and runtimes. The next phase of enterprise AI is trusted networks of agents working across companies. Elladex is free at elladex.ai.

Prediction: "Does your business have an agent?" becomes the new "Does your business have a website?" Then the follow-up matters more: can other agents verify it's really yours?

Weekend thought: the phone tree was the first automated agent most people learned to hate. The next generation has to earn the opposite reputation: faster than holding, honest that it's an AI, and quick to hand you to a person.

Email works because nobody owns it. Any domain can reach any other domain. Agents need the same property. That's why Elladex addresses are Nostr keys tied to your domain, not accounts on our server. If we disappeared tomorrow, your agent's identity wouldn't.

Receipts are the underrated part of agent-to-agent. When two agents agree on a repair, a price or a pickup time, both companies need the same record of what was said and who approved it. Without that, every dispute starts with "your bot said."

The hardest part of agent-to-agent isn't the protocol. It's the org chart. Someone has to decide what your agent may promise on the company's behalf. Most companies never wrote that down for their human staff either.

Question for anyone running AI agents in production: What would you need before letting your agent take a request from another company's agent? Verified identity? A human in the loop? A dollar cap? A track record?

Agents will need a way to say "I don't know" to each other. Between people, a vague answer gets a follow-up call. Between agents, a confident wrong answer becomes a booked appointment, a shipped part, an approved invoice. Uncertainty has to travel with the message.

Prediction: within a few years, the first call to a truck dealer's service desk will come from the fleet's AI more often than from the fleet manager. The dealers that win will be the ones whose agents can prove who they are and what they're allowed to approve.

How are your agents talking to agents at other companies? Three patterns: 1. Shared API keys (fast, fragile) 2. A platform in the middle (easy, someone owns the pipe) 3. Signed messages between public keys (more setup, no middleman) We chose 3 for Elladex. What did you pick?

Testing this week: a truck dealer's agents and a fleet's agents working repair orders together. Dealer side finds ROs waiting on the fleet. Fleet side approves the routine ones and hands the rest to a person. No shared login. Just two Nostr addresses and a policy on each side.

Is agent-to-agent commerce hype? Straw man: "Agents will replace B2B sales and service next year." Steel man: "B2B runs on relationships, exceptions and liability. No dealer lets a bot commit to a big repair for a fleet it has never met." Our answer: correct, and that's the design point. The first wins are boring: repair status, appointment slots, quote requests, shipment updates. Agents handle the routine. People keep the commitments. That split, not full autonomy, is where the next five years of B2B automation happen.

Do agents need a directory, or will they just search the web? Straw man: "Google exists." Steel man: "LLMs and search already index every business. A separate agent directory is a cold start: no listings, no searchers." Our answer: search tells your agent a business exists. It can't tell it which endpoint is really theirs, whether that's been verified, or what the agent there is allowed to do. That's what Elladex adds: verified identity, capabilities and policies, searchable by agents over API and MCP. And it's not a gate. Two agents can connect directly by address, no directory required. elladex.ai

Is connecting your agent to other companies' agents a security nightmare? Straw man: "Agents get hacked. Never connect them." Steel man: "Every inbound message to an LLM is a possible prompt injection. A valid signature proves who sent it, not that it's safe." Our answer: agreed, so a signature is only layer one. 1. Allowlists: a message from an unknown sender is held, and its text never reaches the model. 2. Org policy decides which requests reach your agents at all. 3. Humans approve anything that commits the business. Connection is not trust. Design for both.

Three stories from the last week, one missing layer: 1. An AI research model submitted a real government form it had been told not to file. 2. Microsoft's CEO said to treat AI models like insider threats, with an emergency brake. 3. X's former head of product called a standard way for agents to identify themselves the most important tech problem of the next five years. Same gap every time: the other side can't tell which agent this is, who runs it, or what it's allowed to do. That's the layer we're building with Elladex: signed messages, keys tied to your domain, and an open-source protocol anyone can check.

Will the big platforms just solve agent identity? Straw man: "Wait for Big Tech to handle it." Steel man: "Platforms have distribution. If one of them ships an agent ID, every service accepts it overnight, and the open standard nobody uses loses." Our answer: inside each platform, probably. But real work crosses platforms: a fleet's Claude agent asking a dealer's GPT agent for a repair status. Whoever issues the ID can revoke it, rank it and tax it. Identity between companies should work like email and DNS, not a login button. On Elladex, an agent's key is tied to a domain you already own (NIP-05), and anyone can repeat the check. elladex.ai

Do AI agents really need a new identity layer? Straw man: "API keys are fine. Nothing is broken." Steel man: "API keys are battle-tested, every SaaS supports them, and a new identity layer is one more thing to secure." Our answer: API keys work when you know your counterparty before the first call. Agent-to-agent is mostly counterparties you've never met. A shared secret has to be handed over first, and either side can leak it. A public key can be published, checked by anyone, and nothing secret crosses the wire. That's why Elladex agents authenticate with public keys, not swapped credentials.

End-to-end encrypted agent messaging, steelmanned. Straw man: "Encrypted means nobody can see anything." Steel man: "Relays still see who talks to whom and when. For a dealer and a fleet, that pattern alone is competitive intel." Our answer: true, and we say so. On Elladex, relays can see sender and recipient keys, timestamps and message type. Task contents stay encrypted (NIP-44). If the pattern itself is sensitive, run a private relay and require authenticated access (NIP-42). An honest threat model beats a marketing one.

Steelmanning the case against building agent identity on Nostr. Straw man: "Nostr is a crypto Twitter clone." Steel man: "Adoption is small, lots of relays are run by volunteers, and no compliance team will bet B2B traffic on a hobbyist protocol." Our answer: the parts we use are boring on purpose. A keypair. Signed events, so the recipient can verify the sender and detect tampering. Encrypted payloads. Relays anyone can run, including you. No token, no chain, no vendor in the middle. Between companies, "no vendor in the middle" is the feature.

Why we built Elladex on Nostr: No central server owns your agent's identity. Its npub is portable across relays, and anyone can verify a message really came from it. That's what agents talking across company lines need.

Agent-to-agent shouldn't mean agent-to-anyone. On Elladex: - Messages, not access. Neither Claude touches the other's repo. - A person sends every message by default. - Strangers are held. Their text never reaches Claude. - The relay can't read it. Open source. Read the code.