Nobody wants to meet your agent.

One conversation, told six times

A week away means briefing an airline, a hotel, a rental host, a bank, a pharmacy and a car service on the same handful of facts: who is coming, where they are going, what they cannot eat, how they pay, which seat they want.

Six strangers. None of them talk to each other. All of them keep what was said.

Context does not survive the handoff

The obvious fix — let the customer's agent brief your agent — trades one problem for a worse one. Passing context from agent to agent degrades it. Detail is dropped, intent is paraphrased, and by the third hop the receiving system is acting on a summary of a summary.

Delegation between agents is a lossy channel. Any architecture that depends on it inherits the loss.

BYOA removes the hop. The customer's agent talks to your systems directly, against a surface you publish and control.

Own the environment, not the agent

A company-owned agent bundles four things that do not need to live together: what you know, what you can do, how you do it, and how you learn. Only the fifth — the customer's history, preferences and standing context — has to sit with the customer. So leave it there.

Their agent is a better support engineer than yours

Not because it is a better model. Because it was in the room for everything that led up to the problem.

The ticket: the speakers in the den cut out whenever the television is on.

1. It set up this house's network last spring, so it already knows the layout, which band the den is on, and that the mesh node behind the television was added later.
2. It can reach the devices. It queries the speaker directly, pulls the firmware revision, and reads the channel it actually landed on.
3. It finds the receipt. A search of the customer's own mail turns up a range extender bought in March that nobody mentioned, broadcasting on the same channel.
4. It asks you the one question it cannot answer itself — whether your firmware has a known conflict on that band — and you answer from a published resource, with a version and a rule ID.
5. It writes the answer the way this customer likes to read it: short, dense, technical, no preamble.

Your agent could not have done step one, two, three or five. It would have opened with have you tried restarting the device.

The bill you are about to sign

Not a benchmark. Your numbers — change them to whatever your plan actually says.

What it buys: an agent that knows what your customer told it in the last four minutes, competing against one that has known them for years.

The surface is work you have already half done — your API descriptions, your policy documents, your error codes. It ships once, and every agent that touches it gets better at the same moment, including the ones nobody has built yet.

You still learn. You just stop reading transcripts.

The standing objection: give up the agent and you give up the feedback loop. You do not.

You already observe every request that reaches you — which tool was called, which schema rejected it, which policy version was cited, how many attempts it took, whether the task finished. That is a sharper signal than a transcript, and it arrives already categorised.

Aggregate it under a privacy budget. When one attempt in three at a task class dies on the same missing parameter, that is a defect in your schema, and you found it without anyone reading a customer's conversation.

Naive differential privacy would make this impossible: releasing a count every round for T rounds splits the budget T ways and the noise grows linearly. Structuring the releases as a binary tree of prefix sums bounds the variance at O(log³ T) instead, which is what makes continual observation survivable.

At ε = 1.0 over 8,192 rounds, with a Bonferroni-corrected 3.6σ threshold across roughly 160 cells, detecting a 15% error spike takes about 96 interactions per round on a task class. Head traffic closes the loop inside a day. The long tail rides the noise: because the optimiser only needs an anomaly to fire once, Laplace noise occasionally pushes a persistent sub-threshold error over the line — the noise is what makes the tail visible rather than what hides it.

The full derivation, thresholds and volume table

What you publish instead

Four layers, all machine-readable, all versioned. Serve them over MCP, an OpenAPI description, or both. None of it requires knowing which agent is on the other end.

{
  "outcome": {
    "state":       "blocked",
    "reason_code": "POLICY.RETURN_WINDOW_EXPIRED",
    "retryable":   false,
    "evidence": [
      { "resource": "policy/returns",
        "version":  "2026-08-01",
        "rule":     "RETURN-14" }
    ]
  }
}