A2A describes the inter-agent relationship; MCP governs tool access; the missing layer connects both to the principal and outcome.
Why this question matters
A2A focuses on agents exchanging tasks, messages, and artifacts. MCP provides structured access to tools, resources, and prompts. A valid A2A request does not automatically authorize every downstream MCP action, and a valid MCP token does not prove that the upstream delegation was legitimate.
Security breaks when systems flatten these boundaries into a single idea of trust. Each handoff needs its own audience, scope, purpose, and provenance while remaining connected to the original human or organizational mandate.
Signals worth observing
- A delegated agent invokes tools outside the task purpose.
- One credential crosses both agent and tool boundaries unchanged.
- The final result cannot be mapped to the tool calls that produced it.
Practical control direction
- Represent inter-agent delegation and tool authorization separately.
- Propagate purpose and principal context without forwarding raw tokens.
- Join A2A task history with MCP call provenance for review.
AgentCollusion lensAgentCollusion focuses on the relationship layer that protocols intentionally leave to deployers and governance systems.
