Xavier Roma Castells Is Asking a Harder Question About AI Agents: Who Do They Work For?

The research engineer’s work on employer and candidate agents has pushed him toward questions of identity, authority, permissions, and what it means for software to act on someone’s behalf.

When Xavier Roma Catells began building artificial intelligence agents for hiring, the technical challenge was not simply whether the software could find candidates or process information. The harder problem was determining what each agent represented and what it should be allowed to do. At Job Protocol, Roma helped create a two-sided architecture in which one agent acted for employers, and another acted for candidates, requiring the system to distinguish between separate identities, objectives, and permissions.

“When two agents represent different sides of the same interaction, you cannot treat them as interchangeable software,” Roma says. “They need different context, different permissions, and a clear understanding of whose interests they are serving.”

Roma is a research engineer who builds AI agents and the systems through which people interact with them. In 2023, he joined Job Protocol as its first engineer and technical lead, becoming the principal architect of its search, hiring infrastructure, and agent-coordination systems. He led development of Holly, an agent designed to work for employers, and Hunter, which was built to represent candidates.

That changed the nature of the engineering problem. An agent working for an employer operates within a different context from one representing an individual candidate. Hunter, for example, was intended to understand a candidate’s experience, goals, and preferences over time. Roma came to see identity as part of the architecture rather than an abstract concern.

“The first question should be who the agent represents,” he says. “Once you know that, you can start defining what it should know, what it is allowed to do, and how another system should interact with it.”

That thinking led Roma to design a two-sided system in which employer and candidate agents could discover one another, exchange structured information, and coordinate while maintaining separate identities and permissions. The architecture was developed in 2023, before Google introduced its more general Agent2Agent protocol in 2025. Roma describes his earlier work as a domain-specific precursor to the kind of interoperability later formalized by that broader protocol. The comparison matters because interoperability alone does not resolve the questions Roma considers most important.

Two agents may be technically capable of communicating, but that does not establish what either is authorized to disclose or what actions it may take on behalf of the person or organization it represents. Roma believes a personal agent’s primary loyalty should remain with the person who authorized it. That does not give the agent unlimited authority. He argues that it must still operate within the law, respect the rights of others, and remain inside explicit security boundaries, with high-stakes or irreversible actions requiring human authorization. Within those limits, however, he believes the agent should protect the interests and confidentiality of the person it represents.

“Making agents communicate is only one layer of the problem,” Roma says. “You still need to know what each agent has the authority to say or do, and where that authority ends.”

For Roma, those boundaries should be enforced through the technical system rather than relying entirely on an agent or provider to exercise discretion correctly. He points to deterministic disclosure controls that can determine what information is available before a model sees or shares it, bounded permissions that restrict which actions an agent can take, and end-to-end encryption that can prevent providers or intermediaries from reading underlying content. His concern is that confidentiality should not depend solely on a provider policy that could later change.

The system Roma helped build moved into actual hiring processes. Job Protocol’s broader platform supported more than 300 completed hires and connected with more than 40 applicant tracking systems. Those integrations show that the architecture was used in actual hiring processes involving employers and candidates, giving Roma direct experience developing agent systems for enterprise use.

For Roma, that use reinforced a larger point about artificial agents. A capable model does not automatically create a dependable representative. The surrounding system has to establish context, permissions, state, and mechanisms for verification and recovery. Without those pieces, the agent may generate useful output while still being poorly equipped to act on someone’s behalf.

“Intelligence is only one part of the relationship,” he says. “An agent can be capable and still be ineffective if it represents the wrong interests or does not have clear boundaries around what it can do.”

His interest in those boundaries reflects a broader shift in agent development. As communication standards mature, Roma believes the difficult questions will increasingly involve identity, loyalty, disclosure, and trust. Engineers will have to decide not only how agents exchange information, but also how another system determines what that agent is permitted to know or do.

Roma also argues that trust between agents should be portable rather than controlled by a small number of platforms. Signed credentials can establish who issued a claim and whether it has been altered, while proof-of-personhood can help establish that the principal behind an agent is a distinct human rather than a disposable bot identity. He also points to zero-knowledge proofs as a way for an agent to verify facts such as eligibility, reputation, or sufficient funds without revealing the private information behind them. In his view, those mechanisms can help agents establish trust while keeping participation open rather than requiring permission from a central intermediary.

Longer-running agents introduce another question about identity. Roma argues that such an agent should be understood as a persistent actor rather than a process that simply runs continuously. It may work in bursts, delegate tasks to temporary agents, or continue operating after models and supporting systems change. What must persist, in his view, is the continuity the agent builds through its work: the knowledge it acquires, along with its objectives, authority, commitments, plans, and record of progress.

“The more an agent can do, the more precisely you have to define the relationship,” he says. “Capability without clear authority creates a different kind of risk because the system can act beyond what the person intended.”

Roma’ perspective comes from working across more than AI research alone. His background includes firmware, distributed systems, financial systems, user interfaces, and hardwareThose experiences have led him to look at an agent as part of a larger technical and human system rather than treating the underlying model as the complete product. That systems view also shapes his advice to other engineers. Roma argues that development should begin with the relationship between the person and the agent, followed by the state, permissions, verification, recovery, and interface needed to support it.

"Evaluating whether a model can do the job is only part of the problem," he says. "You also need to understand who the agent is working for, what its model provider permits or prevents it from, and where the agent’s delegated authority begins and ends."

Roma is now continuing to research how agents can act dependably on behalf of people while still giving those people control over context and authority. He sees agent identity as a practical engineering problem that will become more important as artificial systems gain the ability to operate across increasingly complex environments.

For Roma, increasing capability raises the importance of defining the relationship around the agent. His work is increasingly focused on building systems in which greater intelligence does not leave the person behind the agent with less clarity about what that software can do in their name.

"As agents become more capable, acting on someone’s behalf should not make the agent indistinguishable from that person," Castells says. "The system should preserve who the agent is, whom it represents, and the delegated authority connecting them."