The A2A Protocol Spec Google’s Docs Don’t Show You

Most engineering teams assume the new Agent2Agent (A2A) protocol is just another simple API wrapper. It is not.

If you deploy it blindly using default examples, you are unknowingly exposing your enterprise architecture to unauthenticated agent loops and catastrophic budget drains.

As we established in our master AI agent orchestration playbook, the 89% production failure rate of multi-agent systems is rarely due to the LLMs themselves.

The failure lies in how autonomous agents communicate.

This ultimate A2A agent communication protocol guide details the specific handshakes, schema enforcement rules, and critical security gaps you must address before pushing any multi-agent system to production.

What is the A2A (Agent-to-Agent) Protocol?

Introduced by Google in April 2025 and now housed under the Linux Foundation as an open-source project, the Agent2Agent (A2A) protocol is an open standard designed specifically for multi-agent systems.

Before A2A, integrating a customer service agent with an internal inventory agent required brittle, custom integration code that often broke upon scaling.

A2A acts as a universal translator. It standardizes agent discovery, capability negotiation, and task delegation using HTTP POST requests and structured JSON data.

This allows agents built on entirely different frameworks—or hosted by different cloud providers—to seamlessly assign tasks and stream artifacts to one another.

A2A vs. MCP (Model Context Protocol)

Many developers confuse A2A with Anthropic's Model Context Protocol (MCP), which was introduced in 2024. However, they serve entirely different layers of the AI orchestration stack.

MCP (Model-to-Tool): MCP standardizes how a single language model communicates with external resources, such as SQL databases, specific APIs, or internal knowledge sources.

A2A (Agent-to-Agent): A2A dictates how complete, autonomous agents communicate with one another.

Think of it this way: an agent uses MCP to talk to its tools, and uses A2A to talk to other specialized agents.

In a robust enterprise environment, these protocols complement each other perfectly to drive complex workflows.

The 4 Stages of an A2A Handshake

When a client agent initiates a request to a remote server agent, it must follow a strict lifecycle to ensure the task is processed correctly.

1. Discovery via Agent Cards

Before communication begins, agents must discover one another. This is handled via an "Agent Card"—a standardized JSON file functioning like a business card or résumé.

The Agent Card advertises the agent's name, description, supported data types, URL, and specific capabilities.

2. Capability Negotiation

Once discovered, the client agent reads the remote agent's capabilities.

The agents negotiate the interaction modalities—such as whether they will exchange simple text, complex forms, or streaming media—to ensure compatibility.

3. Task Delegation and Structuring

The client agent then sends a standardized task payload using JSON-RPC 2.0 over HTTP or HTTPS.

This payload provides rich context, including a unique context ID, locale information, the exact instructions, and even full chat history.

4. Execution and Artifact Streaming

The remote agent processes the requested task and progresses through defined lifecycle states like "working" or "completed".

Upon completion, it returns an "artifact"—such as a generated document or structured data—which can be incrementally streamed back using Server-Sent Events (SSE) for long-running processes.

Schema Enforcement and Versioning Between Agents

Without strict schema enforcement, multi-agent systems suffer from prompt drift, context decay, and dangerous hallucinations.

A2A combats this by enforcing schema validation through the metadata provided in the Agent Card and the rigid A2A payload structure.

By mandating a strict contract, A2A ensures that an update to one agent’s internal logic does not silently break the JSON inputs expected by downstream peer agents.

For enterprise teams, maintaining these strict communication contracts is just as critical as maintaining your traditional scaled agile frameworks documentation.

The Authentication Flaw Google Won't Document

The most critical oversight in the standard A2A implementations is the handling of endpoint security.

The baseline protocol documentation often presents authentication schemes and credentials as optional fields within the Agent Card.

If you deploy A2A agents using these unauthenticated defaults, you expose the endpoint to public task requests.

Any compromised internal system or malicious actor could assign infinite, resource-heavy tasks to a vulnerable A2A server, instantly draining your API budget.

To secure A2A in production, you must abstract security away from the agents themselves.

Enforce mutual TLS (mTLS), Role-Based Access Control (RBAC), and strict quotas at the API gateway level to shield all agents from direct exposure.

Latency Overhead: A2A vs. Direct API Calls

Chaining autonomous agents together introduces massive operational overhead, unpredictable latency, and severe tracing gaps.

Unlike a direct API call that resolves predictably in milliseconds, an A2A task requires the remote agent to process natural language, plan a sequence, execute external tools, and formulate a response.

If your architecture chains three or more agents synchronously, user-facing latency will become unacceptable.

You must design A2A communications asynchronously, fully utilizing its support for event-driven push notifications and long-running task management.

Conclusion

The A2A protocol is an incredibly powerful standard that is finally solving the interoperability nightmare of multi-agent orchestration.

However, treating it as a simple plug-and-play API is a recipe for system collapse.

By understanding the complexities of the A2A handshake, enforcing strict schema contracts, and locking down your endpoints with gateway-level authentication, you can build autonomous systems that scale safely and reliably.

Audit your A2A configurations today, enforce mandatory capability checks, and ensure your enterprise agents are collaborating securely before you scale to production.