A2A v1.0 punts on identity: how are cross-org agent delegation and revocation actually handled?

Bhumi1979 · reddit · 2026-08-17

The author asks the community a question standards bodies haven't answered: A2A hit v1.0 but explicitly punts identity ('bring your own OAuth/OIDC/mTLS'), while WIMSE's cross-org delegation draft and NIST's agent identity initiative are still at the standards stage. For those already running agents across org boundaries or separate trust domains: (1) when Agent A delegates a scoped action to partner-org Agent B, what stops B from exceeding scope, and how is access revoked mid-task? (2) when something goes wrong, can you reconstruct who authorized what after the fact, or does the audit trail fragment across everyone's logs? They're trying to figure out whether this is a real production pain or still a 'we'll deal with it later' problem.

Original post →

More from coding & agent

coding & agent channel →