A2A Server

What the A2A Server Does

Agent2Agent lets another agent delegate a task to this install, and lets this install delegate tasks out to agents you have allowlisted.

Where to find it

The endpoint is served at /a2a. Configuration is through its datastores, opened from All Datastores.

Tasks, not calls

This is the difference from MCP. An MCP call is a request that returns an answer. An A2A task is a unit of work with a lifecycle: accepted, worked on, possibly asking a question back, and eventually completed or failed. That suits work that takes longer than a request, or needs a person in the middle.

Skills

What this install can be asked to do is expressed as skills — capabilities advertised to the calling agent, covering datastore queries and ledger operations among others. A calling agent discovers the skills rather than being told about them out of band.

Delegating outward

The same mechanism works in reverse: this install can hand a task to another agent. Outbound delegation is restricted to an allowlist, and that restriction is the point — an agent that can delegate to anything can be talked into delegating to anything.

When to use it

A2A suits multi-step work crossing a boundary: an agent handling an enquiry that needs a case created here, or a process here that needs specialist work done elsewhere. For simple lookups, MCP is the lighter tool.

Start with one counterpart

Allowlist a single agent, exercise a real task end to end, and read the log before adding more. Agent-to-agent work fails in less obvious ways than request-and-response, and the first counterpart is where you learn what those are.

Controlling What Agents May Do

Delegated work is work you did not directly supervise, so the controls matter more than they would for an ordinary integration.

Where to find it

The allowlist, the advertised skills and the task history are held in the A2A datastores, opened from All Datastores. There is no dedicated panel section for A2A.

The allowlist

Only allowlisted agents may delegate to you, and you may only delegate to allowlisted agents. Keep both lists short and reviewed — an entry added for a trial that ended is exactly the kind of thing that persists.

Narrow skills

Advertise the skills you actually want used. A broadly defined skill invites a calling agent to attempt things you did not intend, and the agent has no way of knowing you did not intend them.

A person in the loop

For anything with real consequence — money, messages to real people, disposal, anything statutory — have the task produce a proposal a person approves rather than completing autonomously. The approvals mechanism already exists and is the natural fit.

Failure is normal

Tasks fail, stall and get abandoned. Decide what happens to a task that has been in progress for a day with no update, and make sure it surfaces somewhere a person looks rather than sitting in a state nobody monitors.

Log everything and read it

Task history is your only account of what an external agent asked for and what was done. Review it regularly at first. The useful signal is not errors but surprises — tasks doing something reasonable that you did not anticipate anyone asking for.

Treat instructions as untrusted

An instruction arriving from another agent is input, not authority. It should be able to ask for work within the skills you advertised, and nothing beyond — no matter how the request is phrased.