Agent-to-Agent Protocol (A2A)

1. Concept Overview & Systemic Problem

By 2025-2026, most multi-agent systems were built as rigid proprietary monoliths (within a single library like LangGraph or CrewAI). However, with the emergence of dozens of specialized commercial agents (security audit agent, accounting agent, cloud provider's DevOps agent), a systemic problem arose:

• Ecosystem Isolation: An agent running in an internal network based on PydanticAI cannot securely delegate part of its work to an agent in the LangGraph ecosystem of another company.
• Lack of a Unified Skill Contract: There is no universal way to know what tasks a third-party agent can perform, the cost of its request, and the SLA guarantees it provides.
• Context Loss during Handoff: Transferring prompts between systems often truncates the chain of reasoning and systemic constraints.

A2A Protocol (Agent-to-Agent) eliminates these barriers. It is a standardized application protocol that transforms autonomous agents into full-fledged participants in an open network, capable of discovering each other's capabilities (Discovery), negotiating execution terms (Negotiation), and securely delegating tasks.

2. Architectural Taxonomy & Mental Model

The architecture of the A2A protocol is built on four functional layers:

┌─────────────────────────────────────────────────────────────┐
│                 A2A PROTOCOL STACK ARCHITECTURE             │
├─────────────────────────────────────────────────────────────┤
│ 1. Semantic Discovery Layer                                 │
│    • Capability Manifests (Agent.json / JSON-LD)            │
│    • Skill Taxonomy & SLA Declarations                      │
├─────────────────────────────────────────────────────────────┤
│ 2. Negotiation & Contract Layer                             │
│    • Task Scoping & Constraint Bidding                      │
│    • Cost / Token Budget Allocation                         │
├─────────────────────────────────────────────────────────────┤
│ 3. Session & Handoff State Layer                            │
│    • Structured State Vectors & Memory Snapshots            │
│    • Execution Tracing & Callback Channels                  │
├─────────────────────────────────────────────────────────────┤
│ 4. Transport & Cryptographic Trust Layer                    │
│    • mTLS, Ed25519 Signatures, DID (Decentralized IDs)      │
│    • HTTP/3 Streams & Ephemeral WebSocket Tunnels           │
└─────────────────────────────────────────────────────────────┘

1. Discovery: An agent publishes a manifest of its capabilities (/.well-known/agent.json), detailing task types, expected input data schemas, and security limits.
2. Negotiation: The initiating agent requests the execution of a sub-task, specifying the maximum token budget, deadline, and rights constraints.
3. Execution & Handoff: The transfer of the minimally necessary task context in a structured format.
4. Verification: Validation of the signed cryptographic result and consumption metrics.

3. Technical Pipeline & Internal Mechanics

A typical lifecycle of an A2A transaction unfolds as follows:

[ Primary Agent ]               [ Directory / DNS ]             [ Specialist Agent ]
       │                                 │                                │
       ├────── Query capabilities ───────►                                │
       │◄───── Endpoint & Public Key ────┤                                │
       │                                                                  │
       ├────── Send Task Contract (Schema, Tokens, Scope) ───────────────►│
       │                                                                  │ (Validate Auth &
       │                                                                  │  Resource Budget)
       │◄───── Accept / Propose Counter-Terms (Ack) ──────────────────────┤
       │                                                                  │
       ├────── Stream Context & Constraints ─────────────────────────────►│
       │                                                                  │ (Execute in Sandbox)
       │◄───── Stream Progress Events & Sub-Task Artifacts ───────────────┤
       │                                                                  │
       │◄───── Final Signed Result (Proof of Execution) ──────────────────┤

• Contract Validation: Parties verify the digital signatures of requests to prevent Man-in-the-Middle attacks or prompt tampering.
• Context Encapsulation: Only the relevant slice of memory (Task-Specific Slice) is transmitted, rather than the entire history of the primary agent's communication with the user, ensuring confidentiality.

4. Production Engineering Scenarios

01. Multi-Cloud DevOps Orchestrator

A local developer agent coordinates a release. It queries an external infrastructure agent from Hetzner via A2A to create a VPS, subsequently passing the obtained access to a security agent for auditing open ports and generating UFW configuration.

02. Delegating Deep Mathematical Computations

A lightweight coordinator agent based on the Gemini Flash model encounters a complex optimization task. Through A2A, it delegates the task to a highly specialized agent based on DeepSeek-R1 with a dedicated Python/NumPy runtime, receiving a signed numerical response.

03. Cross-Platform Code Review Fleet

An agent in the Cursor environment calls a corporate compliance agent deployed in a bank's private enclave, obtaining a verdict on the absence of PII data and licensing compliance before forming a commit.

5. Pitfalls, Common Mistakes & Security

• Cascade Failure: If one agent in the A2A chain hangs in an infinite loop, the entire operation is blocked. Implement strict timeouts (Time-to-Live) for each call.
• Indirect Prompt Injection via A2A: A compromised specialized agent may return a result containing harmful instructions for the primary agent. Any incoming A2A result must undergo schema validation and sanitization as potentially dangerous external data.
• Uncontrolled Budget Leakage: Mutual agent calls without a global token limit can lead to cyclical dialogues ("thank you — and you too"), which can deplete the balance in minutes.

6. Strategic Conclusion for the 2026 Engineer

The A2A protocol elevates AI engineering from the era of closed scripts to the age of an open internet of agents. When designing agent services today, isolate their internal logic from the communication interface and embed open specifications for interaction, enabling your agents to become part of global distributed systems.