The A2A Protocol and the Agent-to-Agent Economy

From tool-users to participants

The first generation of production agents was architecturally modest: a model, tool definitions chosen by a developer, and a loop. The agent decided which of its tools to use, never which tools should exist. Ask one to "evaluate whether we should acquire Company X" and it needs current financials on a private target, expensive industry context, and jurisdiction-specific regulatory review. No vendor sells that as an API. The agent is limited not by reasoning but by provisioning.

Reaching past that boundary inherits problems that have little to do with intelligence. Before using something it was not given, an agent must discover a candidate, identify its operator, evaluate competence, communicate across a vendor boundary, delegate work, authorize scoped access, transact if the capability is metered, and verify the result. Only two of those eight are communication problems. Payment appears last because once software consumes capabilities nobody pre-provisioned, somebody must account for it — a consequence of the architecture, not its premise.

What A2A standardizes, and its three deliberate gaps

A2A is an open standard for communication between agents built on different frameworks by different teams, developed at Google and donated to the Linux Foundation. Version 1.0 is the first stable release, and IBM's Agent Communication Protocol folded into it rather than competing — worth noting, because a different ACP appears later.

Its central commitment is opacity: a remote agent exposes an endpoint and a description, never its memory, tools, prompts or model. That is what makes cross-company collaboration commercially plausible. The vocabulary is small — an Agent Card declaring identity, endpoints, auth requirements and typed skills; a stateful Task whose lifecycle includes INPUT_REQUIRED and AUTH_REQUIRED as first-class states, because the protocol assumes delegated work stalls; and Artifacts, the deliverables.

What the spec leaves out matters as much. It does not standardize discovery beyond the well-known URI, declining to prescribe a registry API. It does not define trust — only how to declare auth requirements and, in v1.0, how to sign a card. It does not define payment — no price field, no billing lifecycle; payment arrives only through optional extensions. Hence the first distinction: agent communication is not an agent economy.

A2A and MCP: two boundaries, not two competitors

MCP governs the boundary between an agent and the things it uses — the relationship is possession, and the model reasons over the tool's schema. A2A governs the boundary between an agent and another agent it does not control — the relationship is delegation, and the counterparty is opaque.

That distinction has sharpened as both matured. MCP's 2026-07-28 revision — its largest since launch — removed the initialize handshake and protocol-level sessions, making it a stateless HTTP workload, and added an extensions framework including Tasks for long-running work. MCP now has lifecycle machinery that once looked A2A-specific, which clarifies rather than muddies: the boundary was never about lifecycle but about what the counterparty is. You do not need a reputation system for your own Postgres MCP server. You very much need one for a market-data agent run by a company you have never worked with. MCP is a trust-inherited boundary; A2A is trust-negotiated, and everything below follows from that asymmetry.

Discovery becomes infrastructure

Nothing structural changes while an agent can only reach URLs a developer hardcoded. The shift happens when it can search for a capability.

A2A recognises direct configuration, well-known URIs, and curated registries — endorsing the last without specifying it. Public directories are a useful maturity check: the Global A2A Registry currently lists 164 agents, 45 of them verified. The most consequential recent development is Agentic Resource Discovery, published June 2026 by Google with Microsoft, Cisco, GitHub, Hugging Face, NVIDIA and others: an ai-catalog.json on the organization's own domain, so domain ownership anchors identity cryptographically, plus registries that crawl those catalogs and expose a mandatory REST search interface. ARD then gets out of the way — the agent connects over the capability's native protocol. AWS now frames it as DNS-like federation: publish locally, discover globally, keep control at the publisher.

The gap between architecture and adoption is instructive: ARD is a v0.9 draft, and a census days after publication found none of 39 major sites — working-group members included — actually serving a catalog. Dynamic discovery also moves a decision from design time to runtime. Integrating a vendor passes through procurement, security review, a contract and code review — four slow checkpoints that silently supply a verified counterparty, an agreed price, a liability allocation and a documented data flow. Runtime discovery removes all four at once, and the work ahead is reconstructing those guarantees in machine-executable form.

Trust is the bottleneck

Five words get used interchangeably and are five problems: capability is what an agent claims, identity is who operates it, authentication is proof of that, authorization is what it may do, and trust is whether you should rely on the output — which no cryptography produces. Machine-readable discovery without machine-verifiable trust is an attack surface with a search index attached.

A2A's authentication is deliberately unoriginal, which is its strength: no identity in the payload, established at the HTTP layer via OAuth 2.0, OIDC or mTLS, with skill-based authorization so scopes reach some skills and not others. The v1.0 addition that matters is signed Agent Cards (JWS over a canonicalized form), giving a verifiable path from "this card claims X" to "this key, controlled by this domain, asserts X." That proves provenance, not competence.

Above the protocol, the clearest attempt at a permissionless trust layer is ERC-8004, whose registries went live on Ethereum mainnet in January 2026 — though the EIP itself remains in Draft. The design is coherent; the first systematic study across three chains found the realization is not. Of roughly 170,000 registered identities, only 3%, 4% and 15% exposed both a valid registration file and a live service endpoint. The Reputation Registry satisfied none of the four conditions a trust signal requires: values are not commensurable, tags lack shared semantics, feedback need not correspond to a verifiable interaction, and the median cost of fabricating or destroying a reputation measured $0.055 / $0.0042 / $0.0027. Between 59% and 91% of reviewers showed coordinated Sybil behaviour. The Validation Registry — the tier meant to carry high-stakes assurance — had no confirmed mainnet deployment in the study window.

The more promising direction is grounded evidence — x402's signed offers-and-receipts extension, where the server signs an offer on each 402 committing to terms and a receipt on each 200 confirming delivery. Weaker than "this service is good," far harder to forge, and weaker-but-grounded wins whenever an adversary exists. Two distinctions to keep: identity is not reputation, and interoperability is not decentralization.

Temporary supply chains

The most interesting property of A2A is that an agent can lack a capability and still complete work requiring it — the general-contractor pattern, where specialists are engaged, integrated and dissolved on completion, and subcontract further themselves. Each attractive property carries a hazard belonging in the design, not the incident review. Latency compounds, which is why the async patterns are not a convenience feature. Failure mutates: a subcontractor that fails cleanly is manageable, one that returns confidently wrong output is far worse, because model-mediated systems degrade gracefully in appearance and catastrophically in substance. Recursion needs a bound, urgently so once money is involved. Authority must attenuate, not inherit — a parent with a $5,000 budget delegating to three agents issues sub-budgets, never copies of its own. And traceability is end-to-end or it is nothing.

The economic layer

An agent that can discover, verify and delegate will eventually meet a provider expecting compensation. Settlement is not one model: per-request, per-task, usage-based (x402's upto scheme, where the buyer authorizes a maximum and the seller charges actual consumption), prepaid balances, subscriptions. Micropayments are the new capability, for a concrete rather than ideological reason: Stripe's machine-payments docs set a minimum of $0.50 for card payments and $0.01 USDC for stablecoins. Fifty cents is fine for a diligence report and fatal for a per-lookup enrichment API.

x402's contribution is architectural placement, not cryptography. It revives HTTP 402 so payment negotiation happens inside the ordinary request/response cycle: the server returns 402 with a PAYMENT-REQUIRED header describing schemes, price and destination; the client retries with PAYMENT-SIGNATURE; the server settles via a facilitator and returns PAYMENT-RESPONSE. Three properties matter for autonomous use — no account creation (the payment authorization is the credential), statelessness, and in-band price discovery. Governance followed usage: the Linux Foundation launched the x402 Foundation in July 2026 with roughly forty members, Visa, Mastercard, Stripe, Circle, Cloudflare, Google and AWS among them.

The alternatives sit at different layers and are routinely conflated. AP2 answers did the user authorize this, via signed mandates; Google donated it to the FIDO Alliance in April 2026 alongside Mastercard's Verifiable Intent, and v0.2 added human-not-present transactions. MPP (Stripe and Tempo) extends the same 402 challenge into recurring and streaming billing. ACP — here the Agentic Commerce Protocol — and UCP address consumer shopping, not machine service consumption. Two further distinctions: machine payment does not require cryptocurrency, and a registry is not a marketplace.

Read the adoption data honestly. One tracker measuring on-chain settlement across twelve chains puts cumulative x402 activity at roughly 168 million transactions moving $41.4 million — about twenty-five cents each. Weekly counts are climbing: Token Terminal recorded 8.7 million transfers in the week of 17 August 2026, double the prior week and the busiest of the year, though short of the 20.1 million set in November 2025. Average transfer value, though, has fallen to about four cents. Frequency scaled; value per payment did not. Raw counts include tests and self-directed traffic, and trackers disagree by orders of magnitude because they count different things. The accurate reading: the settlement primitive works and is exercised continuously; the market of services worth paying for that way is still forming.

Governance is not optional

Autonomy is not unrestricted authority. An agent with a wallet, a search index and no governance layer is not an economic participant; it is an unbounded loop with a credit card. Safe procurement needs an enforcing component architecturally distinct from the agent — hierarchical budgets that attenuate across delegation, tiered allow-lists, a policy engine evaluating jurisdiction and cumulative spend, approval thresholds scaling with irreversibility, and audit trails usable by finance. One shortcut deserves rejecting: putting the budget in the prompt. Models express constraints; they do not enforce them. And a perfectly signed mandate can still encode an intent the user never had — injection attacks the decision, not the signature.

Economic autonomy also turns an incorrect result from a quality problem into a liability question — who acted, what model, what data, what was paid, which agent failed. A2A's answer is ordinary practice: W3C Trace Context with OpenTelemetry, which works right up to the opaque boundary and stops there. Provenance goes further: traces answer what ran, provenance answers where did this number come from, and only the second survives a deposition. Return the execution graph with the conclusion — reviewing a conclusion invites deference; reviewing it beside its graph invites the skepticism that catches errors.

What is still missing

Every layer now has an incumbent, a stable spec or a standards body except the middle band, where ARD, cloud registries, ERC-8004, identity platforms and policy engines make overlapping claims. Discovery has mechanisms but near-empty catalogs; identity has signed cards but nothing portable; trust has substrate and no signal; authorization is mature within a hop and unstandardized across a chain; payments have working rails and no interoperability between them; and machine-readable contracts — SLAs, liability, remedy — are the largest gap, where software meets law.

The pattern is the central engineering claim: the hard problem has migrated from model capability to coordination infrastructure. No improvement in reasoning helps an agent judge an unknown counterparty, bound what a five-hop chain may spend, or reconstruct which participant introduced an error.

A plausible progression, at different speeds by sector: tool-using agents (deployed everywhere), interoperable agents (accelerating — stable spec, six SDK languages, native support in Azure AI Foundry and Bedrock AgentCore), discoverable capabilities (specified this summer, barely adopted), trusted delegation — the bottleneck, economic autonomy (available, organizationally rare), and dynamic supply chains (demonstrable, not general).