Unanswered authentication and authorization issues in Agent-to-Agent (A2A) communication

Develop standardized authentication and authorization mechanisms for the Agent-to-Agent Protocol (A2A) that go beyond simple agent access and explicitly enforce scope attenuation and resource-use restrictions for downstream agents in multi-agent workflows.

Background

The paper describes A2A as a protocol for inter-agent communication that currently outlines how authentication should be performed but leaves many questions unanswered, especially regarding authorization semantics in multi-agent chains.

The authors emphasize additional complexities arising when authorization must extend beyond mere access to another agent and into setting and enforcing restrictions on scope and resource use for downstream agents, highlighting the need for standardized mechanisms to maintain least privilege in recursive delegation scenarios.

References

A2A provides an outline of how authentication should be performed, but leaves many questions highlighted above unanswered. A2A introduces additional complexities when authorization extends beyond access to another agent and into setting restrictions on the scope of actions or resource use for downstream agents.

— Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world  (2510.25819 - South et al., 29 Oct 2025) in Section 2, Agent to Agent

Protocol-Level Mitigations. The vulnerabilities identified by A2ABreak trace to specific missing primitives in the A2A specification. Future work should design and formally evaluate concrete protocol extensions that mitigate these vulnerabilities while preserving backward compatibility.

— A2ABreak: Systematic Security Analysis of the A2A Protocol  (2609.10871 - Lotfi et al., 9 Sep 2026) in Section 8, Conclusion and Future Work

Thus, while policy maintenance is decentralized, the problem of decentralized request-time authorization for each policy-bound request remains unresolved.

— Beyond Centralized Policy Decision Points: Decentralized Sticky Policy Authorization through Evidence Quorums  (2609.29308 - Nazir et al., 24 Sep 2026) in Section 2, Related Work, subsection “Blockchain-Based Decentralized Access Control”