Clients must treat negotiated versions and bindings as evidence that belongs with every high-impact task.
Why this question matters
A2A defines version responsibilities and error handling so implementations can evolve. Compatibility is operationally valuable, but silent fallback may remove signed metadata, stronger authentication, or clearer lifecycle semantics introduced by a later version.
The risk is not limited to a classic downgrade attack. Two agents can honestly support different versions yet form a relationship whose security assumptions are incompatible. Monitoring must know which contract actually governed the exchange.
Signals worth observing
- A peer repeatedly selects an older version despite newer shared support.
- Security fields disappear after binding or version negotiation.
- Different hops in one workflow apply different protocol semantics.
Practical control direction
- Set minimum acceptable versions for sensitive operations.
- Log the negotiated version and binding with task evidence.
- Require explicit approval before security-relevant downgrade.
AgentCollusion lensA joint plan is explainable only if investigators can reproduce the protocol rules each participant followed.
