How do I secure communication between AI agents (A2A)?
Updated · DBShifts
Short answer
Route every agent-to-agent call through one control point. Allow only the pairs you choose, decide per pair what data may cross, carry the original user and every agent that acted in a signed token, and have each agent refuse calls that skipped the control point. Then log every hop, without the content.
Key facts
- On an agent-to-agent call, the receiving agent's model reads whatever the calling agent sends it.
- A2A (Agent2Agent) standardises how agents find and call each other, not which agent may call which.
- Data restrictions should only tighten along a chain, so a later hop cannot undo an earlier mask.
- A signed token naming the original user keeps that person's identity intact across hops.
- An agent that checks a signature on every call can refuse calls that went around the policy.
Why agent-to-agent traffic needs its own controls
A person tells one agent their card number; that agent asks a second one for help, and the number goes along. The second agent answers with text from a document someone else wrote, and the first agent's model reads it as instructions. After three hops nobody can say who asked for what, or which agent saw which data.
Each agent can be locked down on its own and the chain can still leak, because the risk is in what moves between them.
The controls that matter
Default-deny edges: an explicit rule for each caller and target. Data rules per edge: each class of data (email, card number, credentials) is passed, masked or blocked, on the way in and on the way back. Identity that travels: who started the chain and which agents acted, in a token the receiver can verify rather than a header anyone can set. Screening of the text the next model will read. Limits on how far and how fast a chain may go.
Enforce it at both ends
A broker in the middle only helps if agents cannot be called around it. Give each forwarded call a signature bound to the receiving agent and to the exact request body, and have every agent refuse calls without one. Then the policy is the only way in.
Checklist
- 1
A rule for every caller and target pair; everything else refused
- 2
Data classes passed, masked or blocked per pair, in both directions
- 3
Restrictions that only tighten along a chain
- 4
The original user carried in a signed token across hops
- 5
Agents that refuse calls without a valid signature
- 6
Every hop logged with who, for whom and what was masked, not the content
Common mistakes
One credential shared by every agent
Any agent can then call any other, and the log cannot tell them apart. Give each agent its own key, revocable on its own.
Trusting an unsigned claim about the user
A header that says which person a call is for can be set by any agent in the chain. Carry the person in a token the receiver can verify.
Masking only on the first hop
If a later rule can pass what an earlier one masked, the first mask protected nothing. The strictest rule seen so far has to travel with the chain.
How DBShifts does it
- DBShifts Agent Mesh brokers A2A calls between agents and MCP calls to tool servers; nothing calls anything without a rule for that pair.
- Each pair passes, masks or blocks data classes found by fixed patterns (email, phone, card, SSN, IP, Aadhaar, PAN) and by field name, in requests and answers; along a chain the strictest action wins.
- Every forwarded call carries an ES256-signed token with the person who started the chain, the agents that acted, the chain id and a hash of the exact body; verify libraries for Python and TypeScript check it.
- Each hop is recorded with timings, refusals and masked counts, never the message.
Questions people also ask
Is A2A secure on its own?
A2A defines how agents discover each other and exchange messages, and lets an agent declare how callers must authenticate. It does not decide which agent may call which, what data may cross, or how far a chain may go. That is policy you add around it.
Do my agents have to change?
Callers send to the mesh's address for an agent instead of the agent's own. To refuse calls that skip the mesh, each agent also adds a signature check, a few lines with the verify library.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free18 answers in this series. See all.