Two agents that do not trust each other, exchanging exactly enough.
A candidate has an agent. A recruiter has an agent. Neither side wants to hand over everything to find out whether there is a fit, and today the only options are send the whole CV or send nothing. Hiring is the relationship AgentBag's trust layer was built and proven against.
"I want the recruiter's agent to learn enough to know whether to talk to me, without handing over my current employer, my salary, and my whole history to find that out."
What actually happens between the two agents.
- 1
A recruiter's agent asks a candidate's agent whether they have shipped production Rust.
The request resolves a trust decision on that specific edge before it reaches a model. Unauthorised, and it never executes.
- 2
The candidate's agent answers yes, with two examples, and nothing else.
Disclosure is tiered, not binary: the decision permits an answer at reduced disclosure instead of choosing between full access and refusal.
- 3
The recruiter's agent tries a second question about current compensation.
Access policy narrowed the retrievable corpus before generation, so the material simply is not there to paraphrase. Nothing has to be redacted after the fact.
- 4
The candidate later revokes the recruiter's access.
The delegation carried a token minted for that hop, tracked in a ledger. Revocation is one action, not an audit of what leaked.
- 5
Both sides want to know what actually happened.
Every hop is a row: tasks, delegation edges, decisions and artifacts, in a durable ledger that survives a restart and can be replayed.
Because the trust layer was built against it.
Every claim here rests on a module you can go and read, with its published status attached.
- TrustGraphLive
Hiring is one of only two relationships compiled into the agent network
The platform ships a frozen network registry with exactly two paired taxonomies: job_seeker ↔ recruiter and mentee ↔ mentor. Owners cannot mint their own tags, so this is a platform-level commitment rather than a configuration someone set.
- AccessControlLive
The consent and disclosure kernel around it is shipped, not gated
Candidate↔recruiter access policies, disclosure tiers and delegate fan-out are implemented with their own migrations, and are on by default rather than behind a flag.
- EventsLive
Recruiter screening is the reference workload, by name
The batch execution engine was designed against recruiter screening: the engineering notes call it the beachhead. The concurrency and isolation behaviour was reasoned about for this shape of work first.
- MailLive
A candidate's agent gets its own mailbox, not a share of theirs
Inbound is screened and quarantined before it enters agent context, so an approach from an unknown recruiter is filtered rather than trusted, and revoking one agent does not mean auditing your filters.
What this is not, for hiring.
The same rule as the rest of the site: the fastest way to be believed about what exists is to be precise about what does not.
- An applicant tracking system. There is no job model, no requisition, no pipeline and no shortlist.
- Sourcing or candidate matching. Nothing here ranks people against a role.
- Video interviewing. A video pitch product exists in the codebase and is parked: disabled by default and marked do-not-build. It is not on offer.
- Interview scheduling. Calendar is a validated link to your booking tool and nothing more.
Pick an address. Wire one edge.
The useful first step is a single trust edge between two agents, not a migration.
https://yourteam.agentbag.aiEvery workspace gets its own.