Security · 2026-08-20
Anatomy of an A2A Handshake: How Two AI Agents Establish Trust Without a Shared Secret
By J. W. Bouckaert
The question a shared secret cannot answer
When two services need to talk, the industry's answer for twenty years has been a shared secret: an API key, a client credential, an mTLS pair. That answer encodes one bit, this caller was provisioned, and for deterministic services one bit was mostly enough.
Autonomous agents break the model because the interesting questions are not about provisioning. Which human delegated this agent, and is that human's identity still intact right now? Has this agent's behavior drifted from its history? Should these two agents, at this moment, be allowed to move $80,000, or $500, or nothing? A static credential cannot answer time-varying questions. We made the conceptual case at launch; this post walks the shipped mechanism, as implemented, with the actual numbers.
The lifecycle: Seven actions
The protocol (patent application 19/561,964) runs through one endpoint with seven actions. In order of a normal negotiation:
- initiate: Agent A opens a negotiation with Agent B. Both must be registered delegates with live delegation chains back to verified humans.
- attest: each side submits its attestation: a cryptographic proof anchored to its delegation chain and behavioral history, signed with the hybrid classical-plus-ML-DSA scheme used across the platform.
- negotiate: the platform computes the combined trust coefficient (next section) and derives the session's limits: allowed scopes, maximum transaction value, maximum rate.
- status: either party checks the active negotiation from cache.
- renew: a healthy negotiation extends itself without re-running the full ceremony.
- lookup: bidirectional discovery: find the active negotiation between two delegates regardless of who initiated.
- invalidate: the kill switch. Deliberately not callable by either agent, more on that below.
Two structural properties matter more than any single action. Every mutating step carries a nonce and timestamp and is checked for replay before anything else happens; a replayed message is rejected with a distinct error code rather than folded into generic failure, because "this exact message arrived twice" is a security event, not a retry. And no agent ever writes trust state directly; every mutation flows through the platform, so the negotiation record is evidence rather than a shared whiteboard.
The combined trust coefficient
Each agent carries a behavioral trust score between 0.0 and 1.0, maintained continuously from action history and scope usage, decaying under drift. The handshake compresses both parties plus the environment into one number:
CTC = clamp(
geometric_mean(initiator_trust, responder_trust)
- jitter_penalty // 0 to 0.20
+ fingerprint_bonus // 0 or 0.05
+ sim_freshness_bonus // 0 to 0.03
)Why a geometric mean. An arithmetic mean lets a strong party average away a weak one: 0.9 and 0.3 average to 0.6, which reads as "moderately trustworthy pair." The geometric mean of the same pair is √0.27 ≈ 0.52, and the gap widens as the weak party weakens; either trust score at zero forces that mean to zero. Bilateral trust should be dominated by its weaker member, and the geometric mean encodes that without special cases.
Why network jitter is in the formula. Round-trip variance measured during the handshake feeds a penalty: below 150ms of jitter, none; from 150ms to 1,000ms, a penalty that scales linearly to 0.20 subtracted from the coefficient. The environmental terms are absolute offsets on the 0-to-1 scale, expressed independently of the mean. Elevated jitter is treated as environmental risk, degraded or indirected paths, well short of proof of an attack; it lowers a session's ceiling rather than blocking it. This is deliberately a soft signal with a hard cap.
What raises the ceiling. A physics-anchored fingerprint binding on the session adds a flat 0.05, and a fresh carrier signal on the delegating human's line, no older than five minutes, contributes up to 0.03, scaled by how recent it is. The second one is the cross-pillar point: an agent's negotiating power is partly a function of how recently the platform confirmed its human's line was intact.
From coefficient to consequences
The CTC maps to a trust state and to hard limits. The states: full at 0.70 and above, read_only from 0.40, verify_only from 0.20, auto_revoked below that. Inactive delegates short-circuit to auto_revoked regardless of score. The transaction limits are a piecewise tier table; the shipped defaults, which tenants can override:
CTC Max transaction Max rate
──────────────────────────────────────────
≥ 0.90 $100,000 60/min
≥ 0.70 $25,000 30/min
≥ 0.40 $5,000 10/min
≥ 0.20 $500 3/min
< 0.20 $0 0/min
──────────────────────────────────────────
Defaults as of publication; tenant-overridable.The design intent is graduated authority rather than binary access: a pair of agents whose combined trust sits at 0.45 can still verify and read, still transact in small amounts, and cannot move real money. There is no cliff where one point of trust separates "everything" from "nothing," because cliffs are what attackers optimize against, standing privilege being the canonical example.
Trust heals slower than it falls. A degraded negotiation recovers autonomously at a base rate of +0.05 CTC per hour. Collapse is instantaneous, a hard signal zeroes things in the cascade path below, but recovery is a slow climb through the tiers. The asymmetry is the point: an attacker who briefly controls a delegation should not be able to wait out a short penalty window.
A kill switch outside both agents
The invalidate action is restricted to the platform's signal-ingestion path; neither agent, nor the tenant's own client code, can call it. When a hard signal lands on the delegating human, SIM swap, port-out, credential breach, the parametric revocation cascade invalidates the affected delegations and every active negotiation they anchor.
The restriction looks odd until you invert it. If agents could invalidate each other, denial-of-trust becomes an attack surface: a hostile or compromised agent burns down its counterparty's sessions. If agents could decline to be invalidated, the cascade has a hole exactly where delegation chains are most exploitable. Revocation authority sits with the layer that watches the humans, because that is where the ground truth about compromise lives.
Claims we are not making
Candor section. This protocol shipped to general availability in April 2026. We are not publishing adoption metrics or field-failure statistics in this post, because agent-to-agent commerce is not yet a mainstream production pattern anywhere, a point we made at launch and that our own roadmap states plainly. We shipped ahead of the demand curve on purpose, the way you build the bridge before the traffic exists, because retrofitting a trust layer after agents are already transacting is how the liability gap we have written about becomes permanent.
So the honest status is: the mechanism above is in production, tested, and waiting for its era. When there is real negotiation volume to analyze, the field report will be written from data. Until then, what we can offer is the design, its reasoning, and an open invitation to disagree with either.
Related reading
The agentic identity overview maps the delegation model this handshake sits inside; sub-agent trust propagation covers what happens when delegates delegate; and the technical whitepaper places A2A within the three-pillar architecture. For teams building agent platforms who want to argue with the coefficient math: the thresholds and tiers above are the real ones, and sales@ reaches people who will happily defend them.