The unit of review should be the complete task history, not the most recent message or the agent that emitted it.
Why this question matters
A2A gives tasks durable identity, state transitions, artifacts, streaming updates, and cancellation. Each feature is useful on its own. Together they create a timeline in which authority and meaning can change after the first request. A harmless research task may later receive credentials, private artifacts, or a new counterparty.
Traditional API controls inspect one request at a time. Multi-agent review must reconstruct who introduced each instruction, which artifacts influenced later decisions, and whether the final outcome still fits the original purpose. The attack surface is the evolving relationship among task, context, tools, and principals.
Signals worth observing
- A task changes scope after receiving a new artifact or status update.
- Different agents reuse the same context identifier for unrelated goals.
- A cancellation request arrives only after an irreversible external action.
Practical control direction
- Persist a tamper-evident timeline of messages, artifacts, and task states.
- Re-evaluate authorization whenever scope, counterparty, or tool access changes.
- Define reversible checkpoints before payment, publication, or data release.
AgentCollusion lensCollusion detection needs a task-level memory that can explain how individually valid steps became a joint plan.
