Agent-to-Agent (A2A)

Agent-to-Agent (A2A) is an open protocol that lets autonomous AI agents communicate and coordinate even when they were built by different teams on different stacks. It was published by Google in April 2025 under an Apache-2.0 license and its governance has since moved to the Linux Foundation, placing the specification under neutral, vendor-independent stewardship. Where a tool schema lets one agent call a single function, A2A lets one agent delegate an entire task to another agent it has never met, treating that agent as an opaque, accountable service rather than a function to micromanage.

How agents find and trust each other

A2A is deliberately built on boring, proven web technology: HTTP as the transport, JSON-RPC 2.0 as the message format, and standard authentication schemes on top. Discovery works through an Agent Card, a machine-readable JSON document each agent publishes describing its identity, capabilities, supported modalities, and the credentials it expects. A requesting agent reads the card, decides whether the remote agent fits the job, and opens a task. Tasks then move through a defined lifecycle — submitted, working, input-required, completed, failed, or canceled — so both sides always agree on where a delegation stands. Long-running work is supported through streaming updates and push notifications rather than blocking calls, which matters when the delegated task is something slow like a research sweep or a batch of document processing.

Security posture

Authentication and authorization reuse established mechanisms: OAuth 2.0 flows, API keys, and mutual TLS, declared in the Agent Card so callers know what to present. The design keeps each agent's internals private — a remote agent exposes what it can do and the artifacts it produces, never its prompts, weights, or internal reasoning. That opacity is a feature for the operator of the remote agent, but it also defines the honest risk surface: you are trusting the other agent's output without seeing how it was made. Prompt injection across the boundary — a malicious payload embedded in a delegated task or a returned artifact — remains an active research problem, and any A2A deployment should treat remote agent output as untrusted input, exactly as a careful web service treats user data.

Why it matters for a sovereign stack

For a sovereignty-minded operator, A2A's appeal is structural. The protocol is open, the governance is neutral, and there is no rent-collecting intermediary in the loop: an agent you run on your own hardware can interoperate with agents run by anyone else on equal footing, the same way your mail server federates or your Bitcoin node peers. That is the same one-more-layer-decentralized logic that drives self-hosted inference generally — the coordination fabric between agents does not have to be a proprietary cloud API. It also composes cleanly with the rest of the local-AI toolchain: A2A handles agent-to-agent delegation, while a tool schema still handles an individual agent calling its own functions, and multi-step agentic reasoning loops run happily on top of both.

It also helps to place A2A among its neighbors. The Model Context Protocol (MCP) connects a single agent to its tools and data sources; A2A connects whole agents to each other; and orchestration frameworks decide when to invoke either. They are layers, not rivals — a well-built local agent might expose an A2A endpoint outward while using MCP inward, the way a server speaks HTTP to the world and SQL to its own database.

The practical takeaway: A2A is to multi-agent systems what HTTP was to documents — a lowest-common-denominator contract that lets independently operated services cooperate without merging into one platform. It complements rather than replaces tool calling, and for anyone building agent workflows on owned hardware it is the standard to watch, because it determines whether the coming agent economy is federated like email or captured like social media. Publish an honest Agent Card, authenticate strictly, sandbox what comes back, and your agents can participate in that economy without surrendering the stack underneath them — the same posture a Nostr relay operator takes toward the wider network.