Block just shipped a Slack and GitHub killer, and the killer part is not the part they are selling.

The headline writes itself. Jack Dorsey’s company launched Buzz, an open-source workspace where humans and agents work together, and it collapses the two tools every software team lives in. Chat, threads, DMs, the Slack surface, on one side. Repositories, patches, code review, the GitHub surface, on the other. One place instead of two. That is the demo, and it is a good demo. It is also the least interesting thing in the announcement.

The interesting thing is buried in a sentence about identity. In Buzz, agents are not chatbots bolted into a corner. They are participants with their own cryptographic identities, defined permissions, and the ability to post, review code, run approved automations, and hold a conversation next to the humans. Read that twice, because the second clause is the one that matters. Every agent gets a signature. Everything it does is attributable to it, cryptographically, by construction. That is the feature a bank should be reading, and almost nobody is writing about it.

What Buzz actually is

Start with the honest description, because the hype obscures it. Buzz is an open-source, self-hostable collaboration platform, Apache-2.0 licensed, with an optional hosted version. It is model-agnostic: it works with Claude, with Codex, and with Block’s own open-source agent framework, goose. It is built on Nostr, a decentralized identity protocol, which is the tell for where Block thinks the hard problem lives. And it merges the conversation and the code into a single surface so that the discussion about a change and the change itself sit in the same place.

The framing Block chose is deliberate. Bradley Axen, who leads AI capabilities there, put it as a wedge: “Every company is going to need a place where humans and agents work together. The question is whether that place is proprietary or open.” That sentence is aimed squarely at Slack, Teams, and GitHub. It is a good line. It is also, for a regulated institution, the wrong question.

Notice who is making this bet. Block is not a research lab playing with agents in a sandbox. It runs Cash App and a real financial business under real supervision. When a regulated fintech builds an agent-native workspace, dogfoods it, and open-sources it, that is not a science experiment. That is a company betting its own engineering org on a particular idea of how humans and agents should share a room, and then handing you the blueprint.

The trick everyone is underrating

Here is the part that got one paragraph in the launch and deserves the whole post. Block treats identity as the most fundamental problem in multi-agent work, and it solved that problem first, in the foundation, with cryptographic keys. Not as a setting you configure later. Not as an enterprise add-on gated behind a sales call. As the primitive the rest of the system is built on.

That inversion is the whole game. Think about what happens when you bolt an agent onto a tool that was designed for people. The agent acts through a service account, or through a human’s credentials, or through a shared bot token that ten other automations also use. When it posts, comments, or merges, the trail leads back to a generic identity that could have been anyone or anything. You can see that an action happened. You cannot prove who took it. In a system where agents write code and trigger automations, that gap is not a rough edge. It is the failure mode.

Buzz closes the gap at the design layer by refusing to let an agent act without a signature. Every agent is a distinct, key-backed identity, and every action it takes is signed by that identity. Attribution stops being something you reconstruct after an incident from scattered logs and becomes something the platform guarantees before the action lands. That is a different category of control, and it is the one a bank has been told, repeatedly, that it needs.

The trend Buzz is arguing with

Buzz is not the only bet on the table. It is one side of a split that is defining how agents join the workday, and the split is worth naming because a bank has to pick a side deliberately rather than drift into one.

On one side, the incumbents are bolting agents onto the surfaces you already use. GitHub shipped Agent HQ, a control plane to orchestrate any agent, its own Copilot plus third-party agents from other labs, across the tools developers already live in. Slack is filling with agents through Agentforce and a growing roster of partners plugged in over the Model Context Protocol. In this model the agent is a guest in a human-built house, and it usually inherits an identity the house was never designed to give it.

On the other side is Buzz, built agent-native from the first commit. Agents are not guests. They are residents with keys. The conversation and the code are unified rather than federated across two products. And identity is the foundation instead of a patch.

I have argued before that agents are becoming coworkers, not tools, and that the interesting questions are organizational rather than technical. In Agents Don’t Commute the point was that a workforce that never logs off changes the shape of the work. Buzz is the logical next step: if agents are coworkers, they need what every coworker in a regulated firm needs before their first day, which is a badge, a scoped set of permissions, and a record of everything they touch.

Why this is precisely the bank’s problem

Put the two facts together and the banking implication is sharp. Humans and agents on one surface. Agents writing code and running automations. The instant those are both true, the load-bearing control is no longer the model’s accuracy or the pipeline’s speed. It is the answer to a single question: which agent did this, under whose authority, and can you prove it.

Every regulated obligation a bank carries flows through that question. Change management wants to know who authored and who approved a code change, and segregation of duties wants those to be different accountable parties. An audit wants a tamper-evident record of what happened, in what order, by whom. Model risk and operational risk both assume you can attribute an action to an actor and hold someone answerable for it. None of that survives an agent acting through a shared service account. You cannot run segregation of duties against an identity that is really a dozen automations wearing one badge.

This is why non-human identity has quietly become one of the harder governance problems in large institutions, where machine and agent identities already outnumber human accounts by a wide margin, and why bodies like the Cloud Security Alliance are publishing governance frameworks specifically for it. I wrote the first version of this argument in Non-Human Identities: When AI Agents Need Employee Badges. Buzz is what it looks like when a vendor takes that argument seriously and builds the badge into the floor.

And the badge only matters if the agent can actually prove it holds it. I traced the ugly empirical side of that in Only Thirty-Two Percent of the Time Can the Agent Prove It’s Itself, where agents handed a cryptographic identity workflow completed it as little as a third of the time. A signature primitive is necessary. It is not sufficient until the agent can execute the handshake reliably. Both things are true, and a bank has to hold both.

Governed First, But Open Earns Its Keep

Axen framed the choice as proprietary or open, and for a startup trying to pry customers off Slack that is exactly the right wedge. For a bank it is the wrong first question. The axis you are graded on is not open versus closed. It is governed versus ungoverned. A closed tool that makes every agent action attributable, least-privileged, examiner-legible, and reversible beats an open one that does none of that, and an open tool that skips those properties is just a liability you can read the source of.

Settle that first, because it is the part most people get backwards. But once a tool clears the governance bar, open stops being irrelevant and starts to earn its keep. Between two workspaces that both satisfy the controls, the open one hands your engineering team advantages the closed one structurally cannot, and the biggest of them is the one Buzz built its whole foundation on.

Identity is the single worst thing to be locked into. On a proprietary surface, an agent’s identity is a platform account or a vendor-managed API key. It lives inside that vendor’s system, it is only as portable as their export tools allow, and it dies the day the contract does. You do not own the badge. You rent it. When you switch vendors you do not migrate your agents, you re-issue them, and every attribution trail that pointed at the old identities now points at nothing.

An open protocol inverts that. Buzz is built on Nostr, where an identity is a cryptographic keypair the holder owns outright, not an account a company holds on their behalf. Block is explicit about the consequence: in its own words the agent identity “isn’t tied to a platform account or an API key managed by a vendor,” it is “portable, verifiable, and independent,” and the agents “can participate across any Nostr-compatible system.” The key is the identity, and the key is yours.

For a bank that is not a licensing footnote. It is a strategic opening. The hardest part of the non-human-identity problem I laid out in Non-Human Identities: When AI Agents Need Employee Badges is not minting agent identities, it is governing them coherently across a dozen tools that each model identity differently. An open identity primitive lets you standardize once: give every agent a key-backed identity that any compliant tool can verify, wire that primitive into your existing identity and access management, and carry it across the whole toolchain instead of re-modeling attribution every time you swap a vendor. You are betting on interoperability rather than on one vendor’s roadmap surviving the decade.

The rest of the open advantages are smaller but real, and they all point the same way.

Read the control, do not trust the datasheet. When the signing and attribution logic is open source, your auditors and model-risk reviewers can inspect exactly how the control works, down to the cryptographic primitives. Open crypto is inspectable crypto. That is a stronger assurance than a closed vendor’s SOC 2 summary, which tells you someone else checked, not what they checked.

Keep the room inside your walls. A self-hostable workspace runs on infrastructure you control, so the code, the conversations, and the agent activity stay inside your perimeter. For an institution carrying data-residency and sovereignty obligations, that is a posture a multi-tenant SaaS cannot match.

Control the roadmap, and fork if you must. A permissive Apache-2.0 license lets you patch on your own security timeline and extend the tool to fit controls a vendor would never prioritize, rather than waiting in a support queue or absorbing whatever a post-acquisition roadmap decides to become. You are not captive to the vendor’s incentives.

None of this reverses the first point. It sharpens it. Governance is the price of admission, not a bonus the license throws in, and an open tool that fails the six requirements below is still a liability no matter how readable its source. But when two tools both pass, the open one lets you own the identity, read the control, hold the data, and steer the roadmap. So keep asking your question rather than Axen’s, governed or ungoverned, and treat open as the tiebreaker that decides which governed tool you would rather live with for ten years.

Steal the primitive: what to require from any agent tooling

You are almost certainly not going to self-host a Nostr-based workspace as your bank’s system of record this year. That is fine. The point of Buzz is not that you adopt it. The point is that it makes concrete a set of properties you should require from whatever agent tooling you do adopt, whether that is Agent HQ, Agentforce, or something built in-house. Treat the following as a procurement checklist, not a wish list.

A distinct cryptographic identity per agent. No shared service accounts, no borrowing a human’s credentials. Every agent is a unique, key-backed non-human identity that can be enumerated, attributed, and revoked on its own.

Signed, tamper-evident logs of every agent action. Not application logs you hope are complete. A record where each consequential action is signed by the acting identity and cannot be altered after the fact. This is the artifact an audit actually needs.

Scoped, least-privilege permissions per agent. The agent gets exactly the capabilities its task requires and no more, and those scopes are inspectable and enforced by the platform, not by the agent’s own good behavior.

A mandatory accountable human on every merge. An agent can author a change and open the pull request. A named human owns the approval and the consequence. Segregation of duties does not bend just because one of the parties is a model.

Change records that satisfy the control, not just the engineer. When an agent ships code, the record maps cleanly onto your existing change-management and segregation-of-duties controls. If your process cannot express “agent authored, human approved, both attributable,” fix the process before you let the agent near the repo.

A revocation and kill path. You can turn a specific agent identity off, immediately, without turning the platform off, and you can prove it was off after the fact.

If a vendor cannot demonstrate those six, the open-source flag on the box does not save you. If a vendor can, the closed-source flag does not disqualify it.

Consolidate or federate

The second decision Buzz forces is architectural, and it is genuinely two-sided. Buzz consolidates chat and code into one surface. The incumbents keep them separate and bridge agents across both. Neither is obviously right for a bank, so decide it on purpose.

Consolidation buys you shared context. The discussion, the decision, the code, and the agent that touched all three live in one place, which is exactly the environment where an agent does its best work and where a human reviewer can see the whole story without stitching four tools together. The cost is blast radius. One surface that holds chat, code, and the integrations into your data systems is one surface whose compromise reaches all of it, and one change-control boundary that now spans two domains that your existing controls treated separately.

Federation buys you containment and best-of-breed. Your code tool stays your code tool with its mature controls, your chat tool stays your chat tool, and agents move between them across bridges you can inspect. The cost is seams. Identity has to be federated across systems that each model it differently, context gets lost in the handoffs, and every bridge is a place attribution can break.

The decision rule is not a preference. It is a function of two things: how much blast radius your risk appetite tolerates on a single surface, and how mature your agent-identity governance already is. A shop that has not solved attribution should not consolidate everything onto one surface and hope the platform sorts it out. A shop that has solved it may find the shared-context gains worth the concentration. Answer those two first, and the architecture falls out.

Signals worth watching

Strip the narrative away and here is the short list I would pin to the wall if I ran engineering inside a bank.

Identity is becoming a procurement primitive. “Every agent has a distinct, signed identity, and every action is attributable” is moving from a nice-to-have to a line item you will refuse to buy without. Buzz just made it a headline feature instead of fine print.

The consolidation bet is now live and credible. Someone serious is betting that chat and code merge into one agent-native surface. Watch whether shared context beats federated best-of-breed, because the answer reshapes your tooling roadmap either way.

Open and decentralized is the wedge vendors will push. Expect “own your workspace, own your identity” as a sales motion aimed at your data-sovereignty instincts. The upside is real once governance is met, portable identity, inspectable controls, and data that stays inside your perimeter, but weigh it against the enterprise support and reliability you would give up, and do not let the open-source flag stand in for governance.

Agent-authored code forces a governance model before adoption, not after. The moment an agent can open a pull request, your change-management and segregation-of-duties questions are due. Answer them before the pilot, because retrofitting attribution onto a running system is how the cliff arrives.

A regulated fintech dogfooding this is the tell. Block is not selling you a demo of a future. It is running its own engineering on an identity-first, agent-native surface today, in a supervised business. That is a stronger signal than any keynote.

What I don’t have figured out

I am not neutral, so here is the other side honestly. Buzz may never dislodge enterprise Slack and GitHub, because ripping out the tools an entire org lives in is a different and much harder problem than shipping a better-designed one, and Block knows it. A Nostr-based, self-hosted workspace is a heavy operational lift for a bank that is not staffed to run it, and the sovereignty it offers comes with a maintenance bill. Several of the numbers floating around this space, the identity population ratios, the adoption figures, are softer than they are quoted, and I have kept them out. And open source is not automatically governable. A tool you can read the source of can still fail every one of the six requirements above.

What is not soft is the design choice underneath the launch. When a regulated fintech builds the workspace where its own humans and agents will work together, the first problem it chose to solve was identity, and it solved it with a signature on every action. The Slack and GitHub killer framing will get the clicks. The signature is the part that will still matter after the hype clears, because it is the part your auditor was always going to ask about. Steal it. Demand it. The vendor that hands it to you, open or closed, is the one worth talking to.

---

The consolidation is the pitch. The signed identity on every agent action is the product, and it is the one thing on that launch page an examiner would recognize on sight. Build the requirement before you run the pilot. The companion read is Non-Human Identities: When AI Agents Need Employee Badges, which is where this argument started.

I write about AI-assisted development, enterprise architecture, and the widening gap between what AI vendors ship and what regulated institutions can actually govern. Find me on X @orestesgarcia or LinkedIn /in/setsero.