This is part five of Sandmark's nine-part series on Agentic AI. Part four is available here.
AI agents can already talk to each other. What they cannot yet do is collaborate on data their owners are not allowed to share, and the most valuable jobs in agentic finance, such as moving money, checking customers and running regulated processes, are precisely the ones that requirement blocks.
Agentic finance refers to AI-powered software that holds money and spends it without a person approving each payment. That gap in what agents can share is now drawing its own infrastructure. Silence Laboratories, a Singapore-based cybersecurity firm, has contributed AP3, an open-source protocol that lets agents calculate a shared result without revealing the data behind it, to the Linux Foundation Decentralized Trust - a non-profit body that hosts open technical standards under neutral governance and is also home to main efforts to get agents to work with one another. The bet is that privacy, not capability, is what stands between AI agents and serious institutional use.
The push comes as the industry's biggest names wire agents directly into customer accounts. Coinbase for Agents, which went live this month, lets customers connect AI agents that trade, pay and execute workflows within limits that the customer sets. Robinhood offers an agentic account for exploring trade ideas, building portfolios and placing trades, and Kraken is set to reintroduce its app with agentic trading at its core, CNBC reported. Circle CEO Jeremy Allaire argued in a 13 Jul essay that autonomous agents and money held on public blockchains fit together "like a hand and a glove."
When agents collaborate today, they typically use Agent2Agent (A2A), Google's messaging standard, or something similar. One agent sends another a file, a credential or a piece of context, and that information travels inside the prompt, the block of text an AI model is given to work from. It therefore passes through the model provider's systems and often its logs.
Those protocols were designed for interoperability rather than data protection, said Jay Prakash, founder and CEO of Silence Laboratories. For low-risk tasks, that is fine. It breaks down when the agents belong to organizations that are not permitted to see each other's data: agents from two different banks, or a custody agent working with a compliance agent at another firm.
"That's where the real value of multi-agent systems lies," Prakash told Sandmark, and exactly why private key fragments or customer records cannot sit in a third party's prompt history.
The result, he argues, is a false choice. Institutions can let agents share sensitive data broadly and lose control of it, or wall the agents off and lose the value of collaboration. No bank was ever going to hand its data to another bank's agent on trust.
AP3 approaches the problem with multi-party computation (MPC), a cryptographic technique in which several parties jointly calculate a result without any of them seeing the others' inputs. Silence Laboratories has spent years applying it to crypto custody, where a private key is split into fragments, known as shards, held in separate places, and transactions are signed through a shared calculation without the full key ever being assembled anywhere. BitGo uses the company's MPC libraries in its institutional custody infrastructure. The two firms recently agreed to work together on wallet infrastructure designed to withstand future quantum computers, which are expected to be capable of breaking the encryption in common use today.
Under AP3, agents needing to compute on shared data do not exchange raw inputs or push them into a model. The computation runs through a cryptographic layer and reveals only the result the parties agreed to produce. Two banks could check whether the same customer appears on both their risk lists, and get a yes or no, without either bank ever seeing the other's list.
"The agents handle the intent; the cryptography handles the secret. The two never meet," Prakash said.
In the emerging agent stack, each standard has a lane. A2A lets agents talk to each other. The Model Context Protocol (MCP), Anthropic's open specification, lets them use outside tools. AP2 handles agent payments. AP3 is pitched at the layer none of them cover: joint calculation on data nobody will disclose. Whether it becomes the standard for that layer is an open question. Prakash's own argument for open-sourcing it is that no institution would route its most sensitive workflows through a protocol controlled by a single company.
Even on its own terms, AP3 addresses one layer of a larger institutional problem. Identity and authorization, establishing which agent is acting, for whom, and with what current permissions, sit outside it. So does accountability when an autonomous workflow goes wrong, the question of where liability lands and where a human must stay in the loop, which lawyers told Sandmark in part four of this series, remains unresolved. So does governance over time: withdrawing an agent's permissions, managing the risk that a model behaves unexpectedly and auditing decisions made by systems that change weekly.
The protocol's documentation is explicit that it is deliberately narrow and built to sit alongside the standards covering those other layers, rather than replace them.
The nearest competitor, by Prakash's own account, is not another protocol but the default: teams pasting sensitive data into prompts because it works today and the leak is invisible until it isn't. "We're competing with 'good enough,'" he said, "and in regulated finance, 'good enough' has a way of ending up in an enforcement action."
That is a vendor's framing of the market, and it comes with a vendor's interest attached. But the underlying claim that institutions will not put agents into regulated workflows until data control is solved at the infrastructure layer, matches what this series has found elsewhere: the stack is built, the payments are starting to flow, and the institutional money is still largely watching.
