« Track Overview · Warmup · Hitchhiker's · Deep Dive · Principal Deep Dive · Core Contributor · Staff Notes

Phase 03 — A2A & ACP: Inter-Agent Coordination and Task Delegation

Answers this JD line: "Architect and evolve the agentic runtime to natively support the emerging multi-protocol stack: Model Context Protocol (MCP) for agent-to-tool access, Agent-to-Agent (A2A) for inter-agent coordination and task delegation, Agent Communication Protocol (ACP) and equivalent emerging standards, ensuring the platform is interoperable with hyperscaler agent fabrics (Azure AI Foundry agents, AWS Bedrock Agents, Google ADK)."

Why this phase exists

MCP made an agent's tools uniform. It did nothing for the problem a large bank hits about six months later: Group Compliance's screening agent and Wholesale's investigation agent need to work together, and neither team will absorb the other's code.

That is delegation, and it is structurally different from tool calling in five ways:

1. The work is long-running. A tool call returns in a second. A delegated task may take minutes, or park for hours awaiting a human. A request/response shape cannot hold it.
2. The result is an artifact, not a return value. "The sanctions screening report" is a durable object with its own identity — and it is the thing an auditor asks for, not the conversation that produced it.
3. The callee can talk back. input-required and auth-required are lifecycle states. A tool cannot ask you a question; an agent can and must.
4. It is cancellable. Because it is long-running, and because the user left.
5. It crosses a trust boundary. The callee is another team's system, possibly another vendor's. Everything about identity, data classification and tenancy becomes explicit.

And then the sentence that this phase is really about: A2A specifies all of that shape and none of the admission control. It tells you how to send a task. It says nothing about how deep delegation may go, whether you are about to form a cycle, whether that agent may see this tenant's data, or whether it is cleared for this classification. In a bank, that undefined half is where the risk lives.

Five ideas carry the phase:

1. A task is a first-class, long-lived object with a lifecycle, a context, artifacts, and a history — not a request.
2. Discovery is a card, and cards are prompt surface. An Agent Card's description enters your model's context exactly as a tool description does, with the same injection implications.
3. The delegation chain comes from the caller, never the message. A callee that can state its own position in the chain can erase a hop.
4. Depth and cycles must be bounded. Unbounded delegation is a distributed infinite loop with a bill and no single owner.
5. The kernel must not learn a protocol's vocabulary. A2A, ACP and each hyperscaler fabric are edge adapters over one internal task model — otherwise every spec revision is a rewrite of your state store.

Concept map

• Why not MCP for this: tools are invoked and return; agents are delegated to and collaborate. Trying to model a two-hour task as a tool call produces timeouts and lost work.
• A2A objects: AgentCard (discovery) · Task (the unit of work) · Message (a turn) · Part (text / file / data) · Artifact (durable output) · contextId (the grouping key).
• Task lifecycle: submitted → working → completed | failed | canceled | rejected, with input-required and auth-required as the interactive branches.
• Interaction modes: message/send (blocking) · message/stream (SSE updates) · push notifications (webhook callback for work that outlives any connection).
• ACP: a REST-shaped sibling — runs, multipart messages, sync and async execution. Different words, same concepts.
• Hyperscaler fabrics: Azure AI Foundry Agent Service, AWS Bedrock Agents / AgentCore, Google ADK + Agent Engine. Interoperating means fronting them and being fronted by them without losing your identity and policy at the boundary.
• The admission layer (yours): delegation depth, cycle detection, tenant, data classification, acceptable authentication, and the identity chain.

The lab

Integrated scenario (how this shows up at work)

A payment investigation needs three things: a sanctions screening (Group Compliance's agent), a counterparty risk view (Credit Risk's agent), and a policy interpretation (Legal's agent). The investigation agent delegates all three, in parallel, under one contextId.

Two of them come back with artifacts. The third asks a question — input-required — and parks for forty minutes until a human answers. Meanwhile the user closes their laptop, so the answer arrives via a push notification rather than an open stream.

Then the Credit Risk agent, doing its job, decides it needs a sanctions screening too, and delegates to Group Compliance — which is already in the chain. Without a cycle check, that is a loop across three organizations, each one billing tokens, with no single owner able to see it.

Every element of that scenario is in this lab, including the loop.

Deliverables checklist

• Lab 01 green under LAB_MODULE=solution pytest and under your own lab.py.
• You can state five structural differences between a tool call and a delegated task.
• You can draw the A2A task lifecycle and justify input-required and auth-required.
• You can explain what an Agent Card contains, and what should not be published in one.
• You can name five things A2A does not specify that a bank must add.
• You can explain why the delegation chain must come from the caller's verified context.
• You can explain the SSRF in push notifications and its two controls.
• You can argue for a protocol-agnostic core, and describe what a lossy mapping (ACP has no rejected) obliges you to do.

Key takeaways

• Delegation is not tool calling. Long-running, artifact-producing, cancellable, interactive, and across a trust boundary — each of which breaks the request/response assumption.
• A2A gives shape, not admission. Depth, cycles, tenancy, classification and auth are yours, and they are the entire risk surface of multi-agent flows.
• The chain is derived, never asserted. A callee that names its own place in the chain can erase a hop, and the hop it erases will be the interesting one.
• Cards are prompt surface. Same injection channel as tool descriptions, now across an organizational boundary.
• A caller-supplied callback URL is an SSRF. Allow-list the host; require a verifiable token.
• Adapters at the edge, one model in the middle. That is what makes "support the emerging multi-protocol stack" a design rather than a treadmill.