03 · Actions · A2A extension URI

Confidential A2A
(cA2A) v0.1

cA2A (Confidential Agent-to-Agent) adds safety checks to A2A, a common protocol for one AI agent handing work to another: who passed the job on, how much permission came with it, and a signed record of each hand-off. The address below is the official name agents use to say they support it.

This page is what the cA2A v0.1 extension URI resolves to. The URI is an identifier, not an endpoint: A2A agents put it in their Agent Card to advertise the profile, and clients echo it in the A2A-Extensions header to opt in.

https://agentrust-io.com/extensions/ca2a/v0.1
What it adds

A trust envelope around a delegated task

No agent is served on this domain. agentrust-io.com and its subdomains publish specifications and documentation. They do not host an A2A agent, an MCP server, or a Signed Agent Card. The card linked below is a reference example whose interface URL points at example.com deliberately.

In plain terms: A2A can already show which organisation published an agent's description. cA2A adds proof of what each hand-off was allowed to do, and it fits inside fields A2A already has, so agents that have never heard of cA2A keep working.

A2A's Signed Agent Card answers one question: did the domain owner issue this card. cA2A adds a trust envelope around a delegated task, carried entirely in A2A extension metadata. It defines no new wire format and no new endpoint. Removing every cA2A key from a message leaves a valid A2A task, which is what lets a cA2A deployment interoperate with peers that have never heard of the profile.

Each addition rides on an existing part of A2A. A delegation credential is a signed note saying who handed the task to whom and with what permission. A measurement is the fingerprint of the software a chip reports it is running. A DAG (directed acyclic graph) is the family tree of hand-offs.

A2A elementcA2A addition
Agent CardAn attestation measurement expectation for the peer, checked before a task is accepted
Task messageA delegation credential naming issuer, subject, scope, depth, and parent link
Task payloadSealing to the peer's attested measurement
(none)A per-hop provenance record linking to its parent, forming the delegation DAG
Declaring support

One entry in the Agent Card

An Agent Card is an agent's public description, a small JSON file listing what it can do. Saying "I support cA2A" takes one entry in it.

An agent supporting the profile advertises the URI under capabilities.extensions in its Agent Card:

{
  "capabilities": {
    "extensions": [
      {
        "uri": "https://agentrust-io.com/extensions/ca2a/v0.1",
        "description": "Confidential A2A v0.1",
        "required": false
      }
    ]
  }
}

required is false because the profile is an overlay. A cA2A peer must treat a message carrying no cA2A keys as ordinary A2A input rather than synthesise a partial trust state from their absence, so a card that advertises cA2A still serves plain A2A clients.

A complete reference card, valid against the A2A v1.0 AgentCard definition, is at /examples/ca2a-agent-card.json.

Status

Developer preview, stated plainly

In short: the delegation checks work today in software, and the hardware part is not finished yet.

The v0.1 URI identifies the profile. The current release, ca2a-runtime 0.4.0, is a developer preview and will change shape before v1. The delegation chain is verified and the payload is sealed, but binding that seal to a hardware-verified peer measurement is not yet wired: the reference transport runs in software mode with assurance="none". Running the peer path end to end off hardware is not evidence that cA2A is attested across trust domains.

Normative sources

This page is orientation

The binding is specified in the cA2A documentation, and that is the text to implement against:

Read the specification Reference implementation