Trust Across Teams: Authentication, Extended Agent Cards, and Signatures
Anyone can hand out a card, so why should you believe one? Today you sign agent cards, canonicalizing before you sign, and hit the most valuable trap in the whole course: sign without stripping default values first, and the signature stops verifying the moment the other side serializes the card differently. Then you move authentication from declaration to enforcement, give the finance team an extended card only authorized callers can see, complete an auth-required task with an out-of-band credential, and finally isolate each tenant's tasks from every other tenant.
Today's Goals
- Can hand-build RFC 8785 canonicalization and a detached JWS signature, and use a delete-the-empty-arrays-then-verify experiment to explain why default values must be stripped before signing
- Can separate the authentication a card declares from the checks the server actually enforces, and implement an extended card that only authorized callers can read
- Can walk an auth-required task to completion, explain why the credential travels out of band and is single-use, and explain why cross-tenant access should come back as not found
Until yesterday your orchestrator took every card it saw at face value. Today answers four questions: is the card genuine, who is knocking, what may they see, and how does the credential travel when a step needs authorization. When you finish, come back to the top and check off the three goals.
Plain-Language Walkthrough
Business cards can be forged
The venue contract arrives bearing the events company's official seal. Why believe the events company sent it? Printing a card or carving a seal is not hard. What makes the contract credible is two things: the seal can be checked against the official registry, and every page carries a seal across its edge, so changing a single word breaks the alignment.
An A2A card sits at /.well-known/agent-card.json, and anyone can publish one under their own domain claiming "I am the finance team." Its skill descriptions are written for your model: your orchestrator decides from them whether to hand over work and what to hand over. A forged card can trick you into sending budget data that was meant for finance.
v1.0 adds signatures to cards (JWS, RFC 7515). Everything today extends from that one question: how a card is signed, how a caller is recognized, where to put what only authenticated callers should see, and how the credential travels when a step needs authorization.
Sign in, then link your WeChat mini program account on the account page. Linked accounts share one free article per day. Unlock additional articles with rewarded videos in the mini program.
Scan in WeChat to open Dayward AI. Open the same course and chapter, choose the rewarded video, then refresh this page after completion.
Interview questions
Why must an Agent Card be canonicalized before signing? What has to happen before canonicalization?给 Agent Card 签名为什么要先规范化？规范化之前还要做什么？
Common in ChinaCommon overseasDeep dive#a2a#signature#canonicalization🔒 Unlock this chapter to see the answer keys.
Once a task enters the auth-required state, why should the credential not travel in a message?任务进入待授权状态之后，凭据为什么不该放在消息里传？
Common in ChinaCommon overseasIntermediate#a2a#authorization#security🔒 Unlock this chapter to see the answer keys.
When a caller accesses another tenant's task, why should the server say not found rather than forbidden?跨租户访问别人的任务，为什么应该返回找不到而不是无权限？
Common in ChinaCommon overseasIntermediate#a2a#multi-tenancy#security🔒 Unlock this chapter to see the answer keys.
A remote agent's artifact contains an embedded instruction. How should your orchestrator treat it?远端 Agent 交回来的产物里夹着一段指令，你的编排方该怎么对待它？
Common in ChinaCommon overseasIntermediate#a2a#prompt-injection#security🔒 Unlock this chapter to see the answer keys.