0:00Our briefing agent took one question and handed a part of it to each of two agents.
0:05The currency agent got a sentence our model wrote, with the company, the amount, and the date in it.
0:10A conversion needs the amount, the two currencies, and the date. Naming the company was our model's choice, guided by our instruction.
0:17With a private question, a message like that could carry the user's own details.
0:21Those go to the other team's agent, and what its model does with them is behind its card.
0:26The answer comes back as text from a model we can't see, so our model should treat it as data to check.
0:32That's the client's side. Our analyst sees the same exchange from the other end.
0:37It takes work from any client that sends it a message, and so far those clients have been ours.
0:42Right now it only listens on this machine. Served where others can reach it, any client could send it work.
0:48Every task it accepts runs our model and our lookups, and the model's calls are billed to our account.
0:54Its card, as we wrote it, doesn't ask a caller to prove who it is.
0:58Let's look at what a card can declare about that.
1:01Security schemes say how a caller must prove who it is, and a skill can name requirements of its own.
1:06Once a caller has proved who it is, the agent can show it more.
1:10An agent can keep an extended card for those callers, with skills the public card leaves out.
1:15And a card can be signed, so a client can check who published it, and that it arrived unchanged.
1:20These tell each side who it's dealing with. What a known caller may then do is decided inside the agent.
1:27Some permissions only come up in the middle of a task.
1:30Say our analyst could also look up the holdings in a user's brokerage account.
1:34That account belongs to the user, so the analyst needs the user's permission before it can open it.
1:39So the analyst stops the task in auth required.
1:42The task's status message says what it needs, which is permission to open that account.
1:47That request goes back to the client that handed over the work, our briefing agent.
1:51Now the decision is the client's. It can answer on that same task, or get a person to approve it.
1:57A client that's itself an agent at work can stop its own task the same way, passing the request up.
2:04By default, the credential goes directly to the analyst over a secure channel, so agents in between don't hold it.
2:10With it, the analyst opens the account, and the task goes back to working.
2:14Let's see what our own briefing agent would do with that request today.
2:19This is the end of its loop, where the result of each hand-off is read.
2:23A completed task gives the model its artifact. A task that stops any other way gives it the agent's message, as a question.
2:30A request for authorization would take this path too, and our model would read it like any other question.
2:36So today our model would see that request first and choose what to do. Deciding who approves belongs in our code.
2:44Agent to agent defines how work is handed over and tracked. The decisions around it stay with the programs on each side.
2:51As a client, we choose what each message carries, which agents to rely on, and who grants a permission.
2:57Serving, we choose which callers to accept, and which actions need someone's permission first.
3:04Next time, a client disconnects while our analyst is still working, and we look at how the brief still reaches it.

Delegating Is a Decision

Created by Abhyuday DesaiPublished 4 Oct, v1Runs 3 min 15 sec

0 views

About this video

In Episode 11 of A2A Explained, we look again at the briefing agent from Episode 10 and ask what each hand-off actually carried. The message the currency agent got was written by our own model, and a model we cannot see read it. On the other side, anyone who can reach our analyst can hand it work. The protocol's answers are on the card and in the task, and the decisions stay with us.

You'll learn how to:

See that what a delegation sends is chosen by your program and its model, and treat what comes back as data
Recognize what serving an agent exposes, and that our analyst's card asks nothing of a caller
Name what a card can declare: security schemes, a skill's own requirements, an extended card, a signature
Follow an auth-required task: the agent stops, the client decides, and the credential goes straight to the agent that asked
Find where your own client hands that decision to its model, and decide who should approve instead

This video is for developers who know MCP's vocabulary. The code it reads is in the series repo, pinned to the commit the video shows.

What changed

v104 Oct 2026abhydesai3 min 15 sec9ea712f

First published version.

0 views0 likes on this version