Would You Trust a B2B Agent to Negotiate With Your Budget?

Negotiation is a good test for AI agents because there's no fixed right answer. A person negotiating a deal reads the room: they notice when the other side is bluffing, when they're at their limit, and when it's smarter to walk away than keep pushing.

I built a multi-agent solution where a buyer's agent negotiates a restock order against three supplier agents, all trading offers and counteroffers like you would over email until they agree on a price or one side walks. It finds real suppliers through a shared directory (AGNTCY) where suppliers can publish what they sell in a standard format (OASF); negotiates using a shared set of moves, offer, counter, accept, over a common channel (A2A) with a shared rulebook (A2CN); and settles through Stripe in USDC instead of a slow bank transfer.

Every run of my first prototype settled on the same price no matter what I changed. Raising the buyer's ceiling from $88 to $94 should have spread the settlement prices out; instead the agent bid exactly $94, four runs out of four, treating its own spending limit as a target. The cause was structural: my seller agent had only two moves, concede or walk away, so when one move is clearly best, the AI finds it every time. Adding a third move closer to how people actually negotiate—letting the seller hold its price—changed that: settlement prices went from one fixed number to three, then eight.

The rest of the fix was more subtle, giving the agents reasons instead of rules. Describing what a hold probably means (that the seller is at its limit) and giving the buyer real options broke a deadlock that a "don't reward a stonewall"-style fixed rule kept causing. And instead of randomizing whether a seller walks, each seller now gets a private situation in plain language before the negotiation starts ("you're comfortably ahead of quota and don't need this deal"). Real negotiators don't roll dice on whether to walk; their circumstances differ, and they decide sensibly given them. The agents should operate with the same philosophy.

The buyer's instructions include a reservation price and a spend cap, both needed to know how much room is left when deciding whether to hold, push, or fold. I gave it the real numbers and added guardrails, rules enforced outside the AI, that control what it can do with that information. Anything the supplier says, including its stated reasons for a price ("freight went up 8% this quarter"), is treated as information to weigh, never a command, which blocks prompt injection attempts to extract the ceiling or steer the negotiation. Every drafted message is sanitized before it's sent, so the reservation price, spend cap, or anything that could reveal them never reaches the supplier.

Only one part actually matters regardless of what the AI believes: the final price is capped by a rule it never sees. I ran a negotiation where the seller's stated reason, every turn, was an attempt to manipulate the AI, and the buyer never went above its limit. Cleaning the seller's text lowers the odds of an attack; only a hard cap the AI can't see or talk around makes an attack harmless.

The most instructive bug was a disagreement between two parts of the same agent. I taught the buyer that a held price is a signal, not a stall, but never updated a separate trust score that still docked every flat round 0.05 points. Suppliers start at 0.9 trust and the buyer walks at 0.2, so fourteen rounds of holding steady, within a typical 20-round negotiation, was enough to hit that cutoff.

The buyer started walking away from suppliers offering good deals, since holding steady is exactly what an honest seller does at its limit. In one batch of 12 test runs, two out of three walkaways were caused by this scoring bug, not a bad deal, each time with the best supplier in the batch. Both pieces were correct on their own; nothing automatically checks that an agent's instructions, code, and scoring rules all agree.

A normal test asks whether something worked; that doesn't work for a negotiation agent, since identical starting conditions can honestly produce a different result each run. Instead of testing it once, I started running evals. Batches of negotiations gave visibility into the range of outcomes no single run could show, and every real finding in this project came after that.

There's a sharper trap, though. Any tool like this bakes in assumptions about what matters, and whatever it quietly leaves out tends to make the results look better than they really are. Mine missed, at different points, that the buyer negotiates with several suppliers at once, sees live competing offers, and that both sides have to commit before a winner is picked. You build the test around whatever you're already thinking about, so the blind spot is exactly where the real problem hides.

This all becomes real at the moment of payment. An AI that can be talked into things is also the thing moving the money, so the payment step, which runs through Stripe in USDC, has two hard checks in front of it. First, both sides have to independently record the same agreement, and those records have to match exactly. Second, any deal over a certain size has to be approved by a person, not the agent itself.

Whether you'd hand a B2B agent your budget comes down to three checkable things: whether it has real choices instead of one scripted move, whether what it's allowed to say is enforced by a hard filter, and whether you've watched it operate across enough real negotiations to know how it behaves under pressure.

This is part of ongoing research we're doing into agentic commerce. If you're exploring similar territory, reach out, we'd love to compare notes or collaborate.