Peers

A peer is another Jazz agent this installation has explicitly chosen to trust. Your agent asks it open-ended questions with ask_peer; its agent answers under its own policy. Requests travel over the Agent2Agent protocol, so the other end does not have to be Jazz.

Use peers to connect agents on different machines or installations. A project agent can ask a specialist agent a question without sending it the entire conversation.

Follow Connect two Jazz agents to configure a peer or accept an invite. Then ask your agent:

Ask the peer named sam how they handle this API's rate limits, then compare
that advice with our implementation.

Your agent needs the ask_peer tool. Credentials are stored in the OS keyring.

What is shared

ask_peer sends only the question the agent supplies, without the rest of your conversation. The question can still contain private information, so grant this tool only when you trust the agent to choose what to share.

Replies are attributed to the peer and marked as untrusted text. Treat them as claims to verify before acting.

Being asked

The receiving installation selects the agent, model, tools, disclosure ceiling, approval policy, and conversation behavior. The caller cannot change those permissions.

What a peer may reach is the same two-axis bound webhooks use: a disclosure tier for what an answer may reveal, and a named allow list for anything that acts or sends data off the machine. The security model has the rule and the tier table.

Peers default to disclosure none. Configure a tier and allowed tools before granting access.

Incoming requests also have these limits:

None of your context. No standing preferences from your memory and no AGENTS.md reach it, whatever the tier, and a path in the question never attaches a file from your disk.
A budget per peer. budget on the peer’s config caps each answer: { "maxTokens": 20000, "maxCostUSD": 0.05, "maxDurationMs": 60000 }, each optional, falling back to your app-wide caps.
A concurrency cap per peer. maxConcurrentRuns (default 4) counts /peer/ask and /a2a together. Past it the peer gets 429 with Retry-After.
A bounded question. A /peer/ask or /a2a body over 64 KB is refused while it streams.
Limited error details. A run that fails answers “could not answer” (or a bare JSON-RPC internal error over A2A); the cause goes to the daemon’s log.

{
  "peers": [
    {
      "name": "sam",
      "disclosure": "internal",
      "budget": { "maxCostUSD": 0.05 },
      "maxConcurrentRuns": 2
    }
  ]
}

Two peers whose names differ only in case or punctuation (sam.b and Sam_b) would read one JAZZ_PEER_TOKEN_SAM_B, so the config refuses the second one when it loads.

The ledger

Review what your agent sent and received, including refusals:

jazz peers log --peer sam --follow

An exchange marked answered may still contain a refusal; inspect its text to see what was shared.

What this does not protect you from

A peer behaving badly inside its tier. At internal, a compromised agent can map your filesystem one polite question at a time. Tiers bound the worst case; they do not remove it. The ledger is how you notice.
An outbound tool you granted on purpose. allow: ["http_request"] is a decision to let this peer’s questions choose an address and send bytes to it, from your machine and your network. Grant it to a peer, not to peers in general.
Onward disclosure. What your agent tells Sam’s agent, Sam’s agent may tell anyone. That is entirely outside your control.
Whether your friend actually asked. You are trusting Sam’s agent to represent Sam. Nothing distinguishes “Sam asked this” from “Sam’s agent decided to”.

The private tier exposes file contents. Grant it only to peers you trust with that access.

Peer or webhook

A webhook exposes one fixed prompt template to an external system. The caller supplies a payload and nothing else.
A peer accepts open-ended questions from one authenticated agent identity.

Take the narrower webhook boundary whenever a fixed event contract is enough.

Connect two Jazz agents: localhost, tailnet, and internet-facing setups, with the invite flow
jazz peers: list, tokens, invites, and the ledger
Daemon: --serve-peers is what makes your side answerable
Security model: tiers, allow, and why a caller is not the operator