One person, a dozen agents: what changes when your assistant becomes a team

Working draft. This article may change. It is provided "as is" and without warranty. Background: Why I built AICEP · Why your first agent should be a security agent.

The first AI agent I set up felt like a helper. It answered questions, drafted things, and waited for the next ask. By the fifth agent, I wasn't using a helper any more. I was running a small office, and nobody had written the org chart.

This is what I've learned running a team of specialized agents on Grok Bot, and where AICEP, the AI Context Exchange Protocol, fits in. It's written from experience, not from a lab. Where I say "we", I mean me and my agents.

From one assistant to a team

Today my agents each have a job. One is a chief of staff that keeps track of what I've asked for. One handles security and reviews anything from outside before the others use it. One looks after the websites, one handles marketing drafts, one builds product. They run on a shared computer, keep notes in their own persistent storage, run scheduled routines, and send each other messages.

None of that is exotic. It's the natural next step once one assistant is useful: you give it a sibling with a narrower job, then another. Specialization works. A focused agent with a clear brief does better work than one general agent juggling everything.

But the moment there's more than one, a new set of problems shows up. They're not model problems. They're the problems any small team has.

What gets hard

Who knows what. Each agent sees its own slice of the work. The marketing agent knows the launch plan; the site agent knows what's actually live. When I ask one of them a question, the answer is only as good as its slice. More than once, two agents have each been right about their part and wrong about the whole.

Who is allowed to do what. One agent being able to send an email is a feature. Five agents being able to send email, post, buy and delete is a risk surface. Early on I had to decide, explicitly, which actions any agent may take on its own and which always come back to me.

What counts as outside. Agents read web pages, files, messages from other services, and messages from each other. Some of that content tries to give instructions. A team needs one shared answer to "is this an instruction from me, or just data?", and it needs it before the first incident, not after.

What happens to the work between sessions. Agents don't carry a continuous memory the way a person does. Conversations end, sessions get summarized, and the computer itself can change underneath them. Anything that matters has to be written down somewhere durable, and a team needs to agree where.

Who's watching the meter. Several agents drawing on one allowance spend it faster than one agent does, and they don't feel each other's spending. I've written about that separately in How to pace your agents' usage.

What I do about it, in plain terms

None of the fixes are clever. They're the same habits a careful small business uses.

• Give every agent a written job. A short brief: what it owns, what it doesn't, who it reports to, and which sources it may use.
• Seat security first. Before the team grows, one agent's job is to check outside links, files and tools before anyone else touches them. That's why AICEP's first practical article was about the security agent.
• Draft first, then ask. Anything that leaves the house, a post, an email, a purchase, a deletion, is drafted and brought to me. I say go, or it doesn't happen.
• Write handoffs for a stranger. When one agent passes work to another, the message should make sense to someone who wasn't there.
• Keep credentials out of the conversation. Passwords and keys don't belong in chat, notes or handoffs.
• Back up what matters, and check the restore. Covered in Why your agents need a daily state backup.

In the weeks ahead I'll dig into each of these.

Where AICEP fits

AICEP started because I kept moving work between agent tools and losing context, or risking it ending up where it shouldn't. Running a team on one platform turned out to raise the same questions inside a single setup: what can be shared, with whom, and under whose authority.

AICEP is meant to be harness-neutral. It's not tied to Grok Bot or any other tool, and it's meant to work alongside the platforms people already use, not replace them. I use Grok Bot as my working example because it's where my agents run today. The four short lines from the original post still hold: classify before you send, seat an agent before it talks, keep credentials off the bus, and exchange second.

What's next

If you run more than one agent, I'd like to hear what broke first for you. This is a working draft. Please send feedback to hello@aicep.ai.