Every major agentic platform is converging on A2A as the protocol for inter-agent communication. Salesforce Agentforce, Google Vertex AI, AWS Bedrock, Azure AI, the open-source frameworks — all of them. When that convergence completes, any agent on any platform will discover, message, and collaborate with any agent on any other platform. One protocol. Universal interoperability.
That’s the communication problem solved.
Your organization will have dozens, maybe hundreds, of agents spread across these platforms. All speaking A2A. All discoverable. All capable of invoking each other. Without a governance layer above it, that mesh becomes ungovernable fast. Who registered this agent? What is it authorized to do? What happens when it misbehaves at machine speed?
This is the enterprise agentic control plane — the architecture you build ON TOP of A2A to make it safe, auditable, and manageable at scale.
What A2A Gives You (and What It Doesn’t)
When every platform supports A2A, you get a uniform surface: agents publish Agent Cards describing their capabilities, communicate via JSON-RPC over HTTP, and become discoverable across platform boundaries.
But A2A doesn’t touch governance. It doesn’t decide who is allowed to discover whom, whether a task should execute, what cost limits apply, how identity propagates across trust boundaries, or where the audit trail lives. Those are control plane problems.
Think of it as TCP/IP for agents — it needs everything above it to become enterprise-ready.
The Control Plane
The control plane sits above A2A and provides four capabilities:
┌─────────────────────────────────────────────────────────────────────────────┐
│ ENTERPRISE AGENTIC CONTROL PLANE │
├──────────────────┬──────────────────┬──────────────────┬────────────────────┤
│ REGISTRY │ GOVERNANCE │ SECURITY │ ORCHESTRATION │
│ │ │ │ │
│ - Agent Catalog │ - Policy Engine │ - Identity Fabric│ - Routing Rules │
│ - Agent Cards+ │ - Audit Trail │ - AuthZ Engine │ - Load Balancing │
│ - Versioning │ - Compliance │ - Mutual Auth │ - Failover │
│ - Discovery Gov. │ - Lifecycle Mgmt │ - Token Exchange │ - Circuit Breakers │
└──────────────────┴──────────────────┴──────────────────┴────────────────────┘
│
A2A PROTOCOL LAYER
│
┌──────────────────────┼──────────────────────┐
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ Salesforce │ │ Google Cloud │ │ AWS / Azure / │
│ Agentforce │ │ Vertex AI │ │ Open-Source │
└──────────────────┘ └──────────────────┘ └──────────────────┘These aren’t equal-weight pillars you implement in parallel. The registry is the foundation. Security has the longest lead time. Governance and orchestration layer on top.
Registry
A2A makes agents discoverable — any agent can publish an Agent Card and become findable. In an enterprise, ungoverned discovery means shadow agents, duplicate capabilities across teams, stale endpoints nobody deprecates, and no answer to “which agents process customer data?”
The registry governs discovery. It extends the standard Agent Card with ownership (team, cost center), data classification, compliance tags, approved model bindings, and lifecycle state. Every platform publishes its agents into this extended format. The registry becomes your single authoritative catalog.
Agents move through governed states: Draft → Registered → Active → Deprecated → Retired. Only active agents are returned in production discovery queries. The registry is the gatekeeper for what participates in the mesh.
Governance
A2A lets any agent send a task to any other agent. Governance decides whether that task is allowed to execute.
Policy enforcement happens at A2A gateway sidecars in front of each agent’s endpoint. The big rules: human-in-the-loop for destructive actions on sensitive data, per-agent cost budgets, data residency enforcement (an EMEA agent can’t pull US-resident PII), and caller-tier authorization.
Because A2A standardizes cross-agent communication into one protocol, there’s exactly one interception point for policy. The mesh hooks into that single point on every platform.
Audit captures every A2A task: who triggered it, which agent acted, what identity and tools it used, what data it touched, and which policies fired. Because A2A standardizes task lifecycle states, the audit format is consistent across all platforms. One schema for SOC 2, GDPR, and EU AI Act.
LLM model governance enforces which models agents can use in production — allowlists, version pinning, regulatory classification, and supply chain provenance. Every agent’s model declarations live in its governed Agent Card.
Security
This is the hardest pillar. A2A intentionally leaves identity to the implementation layer, and cross-platform identity is still an unsolved-in-general problem.
The core challenge: agents operate in two modes — delegated (acting on behalf of a user) and autonomous (acting as themselves). Both modes must carry proper identity across every A2A hop.
Identity fabric: a central enterprise identity provider serves as trust anchor. All platforms federate through it. When Agent A on Salesforce sends a task to Agent B on GCP, both verify identity through a shared trust root. No raw credentials cross boundaries.
Mutual authentication: mTLS at A2A boundaries, signed messages (JWS headers), and registry-signed Agent Cards prevent impersonation.
Two-layer authorization: at the A2A boundary, the caller’s Agent Card scopes are checked against the target’s requirements. At the MCP tool boundary, the agent’s permissions are checked against the tool’s declared requirements. Two protocols, one authorization framework.
Credential propagation is the hardest specific problem. A user triggers an Agentforce agent → A2A task to GCP → MCP tool on AWS. Three platforms, three identity systems. OAuth 2.0 Token Exchange (RFC 8693) handles this: at each boundary, tokens are exchanged while preserving the originating user’s identity as an on-behalf-of claim. The identity context rides alongside A2A messages in HTTP headers and is never lost across hops.
Orchestration
The orchestration layer decides how tasks get routed: capability-based routing (query the registry, filter by policy, pick the best agent), failover when agents breach SLOs, and policy enforcement at routing time (EU data never routes to US-only agents).
This is implemented as a distributed policy mesh — sidecars at each endpoint, synced from a central policy engine. Istio for agents.
Dynamic Team Assembly
This is where it gets interesting. The A2A broker doesn’t just route to pre-configured agents. It assembles a team on-the-fly from three inputs: what the task needs, what the registry has available, and what the user is authorized to access.
The flow: decompose the user’s intent into required capabilities → query the registry for matching agents, MCP tools, and LLMs → filter by the user’s authorization boundaries → compose the optimal team → execute with identity and policy at every hop.
Two users asking the same question get different teams. A sales VP gets the full team with competitive intel and a high-end model. A regional rep gets a smaller team scoped to their region, no competitive intel (above their tier), lighter model within their cost allocation. The broker computes team compositions dynamically — it doesn’t hard-code workflows.
Where to Start
Don’t build the full control plane on day one. The sequence matters:
- Registry first. Catalog every agent with enterprise Agent Cards. Eliminates shadow agents and gives you the foundation.
- Identity fabric second. Longest lead time. Set up federation agreements and test cross-platform token exchange. Nothing works until identity works.
- Audit logging third. Capture every A2A task at mesh boundaries. Now you have visibility.
- Policy enforcement last. Start with highest-risk rules in monitor-only mode. Promote to enforcement after validation.
Conclusion
A2A gives us the universal wire protocol. That’s table stakes. The hard part is everything above it: knowing which agents exist, controlling what they can do, ensuring identity propagates across boundaries, and governing the mesh at scale. The control plane is what turns a collection of agents into a manageable system.