A2A Agent Card Governance: Embedding Compliance Credentials in Agent Discovery

0. Prerequisites

# Python
pip install swt3-ai

# TypeScript / Node.js
npm install @tenova/swt3-ai

The wrap_a2a adapter and all witnessing primitives are included in the base package. No additional dependencies required. The adapter is duck-typed and does not import the A2A protocol library.

1. The Agent Card Governance Gap

A2A Agent Cards (typically served at /.well-known/agent.json) declare what an agent can do: its name, description, supported skills, and authentication requirements. This is sufficient for capability discovery.

They do not declare:

• Whether the agent is operating under active compliance governance
• When the agent last produced a verifiable witness anchor
• Which compliance procedures the agent covers
• What clearing level protects inferences handled by the agent
• Where an auditor can independently verify the agent's compliance posture

Without compliance metadata, delegation is a trust-on-first-use pattern. The calling agent has no way to verify the target agent's governance posture before sending a task. This gap has regulatory implications:

• EU AI Act Art. 25: Deployer obligations extend to delegated systems. If your orchestrator delegates to an ungoverned agent, the deployer remains liable.
• NIST AI RMF GOVERN 1.5: Supply chain governance requires visibility into downstream AI components, including delegated agents.
• CMMC: CUI handling across system boundaries requires verifiable controls at each boundary crossing.

2. Extended Agent Card with Compliance Credentials

The swt3 extension adds compliance state to any Agent Card. These fields are machine-readable, independently verifiable, and designed for automated policy evaluation.

{
  "name": "financial-analyst-agent",
  "description": "Analyzes quarterly financial reports",
  "url": "https://agents.example.com/financial-analyst",
  "skills": ["report-analysis", "trend-detection", "anomaly-flagging"],
  "authentication": { "type": "bearer" },
  "swt3": {
    "tenant_id": "ACME_DEFENSE",
    "last_anchor": "SWT3-E-AWS-INF-AIINF1-PASS-1774900000-a1b2c3d4e5f6",
    "procedures_covered": ["AI-INF.1", "AI-GRD.1", "AI-GRD.2", "AI-DEL.1", "AI-TOOL.1"],
    "clearing_level": 1,
    "verify_url": "https://sovereign.tenova.io/verify/",
    "governance_coverage": 0.94,
    "last_witnessed": "2026-07-27T14:30:00Z"
  }
}

3. Populating Credentials from the SDK

Python

from datetime import datetime, timezone
from swt3_ai import Witness

witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="ACME_DEFENSE",
)

# Build the Agent Card compliance extension
card_extension = {
    "tenant_id": witness.tenant_id,
    "last_anchor": witness.last_anchor,  # most recent anchor token
    "procedures_covered": ["AI-INF.1", "AI-GRD.1", "AI-DEL.1"],
    "clearing_level": witness.clearing_level,
    "verify_url": "https://sovereign.tenova.io/verify/",
    "governance_coverage": 0.94,          # compute from your posture data
    "last_witnessed": datetime.now(timezone.utc).isoformat(),
}

# Merge into your existing Agent Card (the dict you serve at /.well-known/agent.json)
agent_card["swt3"] = card_extension

TypeScript

import { Witness } from "@tenova/swt3-ai";

const witness = new Witness({
  endpoint: "https://sovereign.tenova.io",
  apiKey: "axm_live_...",
  tenantId: "ACME_DEFENSE",
});

// Build the Agent Card compliance extension
const cardExtension = {
  tenant_id: witness.tenantId,
  procedures_covered: ["AI-INF.1", "AI-GRD.1", "AI-DEL.1"],
  clearing_level: witness.clearingLevel,
  verify_url: "https://sovereign.tenova.io/verify/",
  last_witnessed: new Date().toISOString(),
};

agentCard.swt3 = cardExtension;

The extension fields are populated from the witness instance's configuration and the most recent anchor state. Update the Agent Card after each witnessed inference to keep the last_witnessed and last_anchor fields current.

Serving the Agent Card

The A2A protocol expects the Agent Card at /.well-known/agent.json. Serve it as a static JSON file or from a dynamic endpoint that refreshes the swt3 fields on each request:

# Flask example
@app.route("/.well-known/agent.json")
def agent_card():
    card = build_agent_card()           # your existing card
    card["swt3"] = witness.agent_card_metadata()
    return jsonify(card)

For static deployments, regenerate the JSON file after each deployment or on a schedule (e.g., hourly cron).

4. Witnessing Every Agent Exchange

The wrap_a2a adapter wraps any object with a send() method, minting a witness anchor on each inter-agent message without modifying the agent logic.

Python

from swt3_ai.adapters.a2a import wrap_a2a

# Wrap the agent - witnesses every send() and handle_message()
witnessed_agent = wrap_a2a(my_agent, witness=witness)

# Use exactly as before
result = witnessed_agent.send({"text": "Analyze Q3 revenue trends"})
# Anchor minted automatically: model_id, prompt hash, response hash, latency

TypeScript

import { wrapA2A } from "@tenova/swt3-ai";

const witnessedAgent = wrapA2A(myAgent, { witness });
const result = await witnessedAgent.send({ text: "Analyze Q3 revenue trends" });

The adapter is duck-typed: it works with any object that has a send() method. No A2A protocol library is required as a dependency. The adapter records:

• Model identifier: resolved from the agent's .model property, .name property, or SWT3_MODEL_ID environment variable
• Prompt hash: SHA-256 of the serialized message payload
• Response hash: SHA-256 of the serialized response
• Latency: wall-clock time for the send() call
• Provider: always "a2a" for inter-agent exchanges

Each send() call produces a witness anchor like:

SWT3-E-AWS-INF-AIINF1-PASS-1774900000-a1b2c3d4e5f6

The anchor is independently verifiable at /verify/ using the fingerprint (a1b2c3d4e5f6) and the recorded factors.

5. Delegation Witnessing with AI-DEL.1

When one agent delegates a task to another, the delegation itself is a consequential decision that should be witnessed. AI-DEL.1 records who delegated to whom, the authorization context, and the scope of the delegation.

# Agent A delegates to Agent B
witness.witness(
    procedure="AI-DEL.1",
    factor_a="orchestrator-agent-v2",
    factor_b="financial-analyst-agent",
    factor_c="task:q3-analysis;auth:role-based;scope:read-only"
)

Combined with a shared cycle_id, delegation anchors create a complete tree structure. During forensic reconstruction, the delegation tree shows:

• Which agent initiated the workflow
• Which agents were delegated to, and in what order
• What authorization context was active at each delegation point
• Whether the scope of delegation was appropriate for the task

This is critical for demonstrating compliance with EU AI Act Art. 25, which holds deployers accountable for the behavior of delegated AI systems.

6. Pre-Delegation Trust Verification

Before delegating a task, verify the target agent's compliance credentials from its Agent Card. This pattern turns agent discovery into a policy enforcement point.

import json
from urllib.request import urlopen
from datetime import datetime, timezone

# Fetch the target agent's Agent Card
card_url = "https://agents.example.com/financial-analyst/.well-known/agent.json"
card = json.loads(urlopen(card_url).read())

# Check for SWT3 compliance credentials
swt3 = card.get("swt3", {})
if not swt3:
    raise RuntimeError("Target agent has no compliance credentials")

# Verify minimum governance coverage
coverage = swt3.get("governance_coverage", 0)
if coverage < 0.90:
    raise RuntimeError(f"Insufficient coverage: {coverage}")

# Verify the last witnessed inference is recent (within 24h)
last = datetime.fromisoformat(swt3["last_witnessed"])
age_hours = (datetime.now(timezone.utc) - last).total_seconds() / 3600
if age_hours > 24:
    raise RuntimeError(f"Last anchor is {age_hours:.0f}h old")

# Verify required procedures are covered
required = {"AI-INF.1", "AI-GRD.1"}
covered = set(swt3.get("procedures_covered", []))
missing = required - covered
if missing:
    raise RuntimeError(f"Missing procedures: {missing}")

# All checks pass - proceed with delegation
witnessed_agent.send(task_payload)

This pattern enforces a minimum governance bar before any delegation occurs. The thresholds (coverage percentage, maximum anchor age, required procedures) are configurable per use case and can be codified in a .swt3-gate.yml configuration file (see the SDK documentation for the gate config specification).

7. Auto-Chaining A2A Workflows

Multi-hop agent workflows involve multiple agents processing a task in sequence. The chain context manager assigns a shared cycle_id to all anchors minted within a workflow, enabling forensic reconstruction of the complete sequence as a single auditable unit.

Python

with witness.chain("a2a-financial-review") as ctx:
    # All anchors within this block share a cycle_id
    result_a = agent_a.send({"text": "Extract financial data"})
    result_b = agent_b.send({"text": f"Analyze: {result_a}"})
    result_c = agent_c.send({"text": f"Generate report: {result_b}"})
    # 3 agents, 1 cycle_id, complete audit trail

TypeScript

await witness.chain("a2a-financial-review", async () => {
  const resultA = await agentA.send({ text: "Extract financial data" });
  const resultB = await agentB.send({ text: `Analyze: ${resultA}` });
  const resultC = await agentC.send({ text: `Generate report: ${resultB}` });
});

Chains support nesting for hierarchical workflows. An outer orchestration chain can contain inner delegation chains, each with their own cycle_id. The swt3 reconstruct command renders these as delegation trees during forensic review.

If an exception occurs within the chain block, the chain is marked as incomplete and the exception propagates normally. Incomplete chains are flagged during forensic reconstruction.

8. Procedure Cards

9. References

• Multi-Agent Witnessing with CrewAI and A2A - Detailed orchestration patterns
• Multi-Agent Chain Audit Trail - Complete chain evidence reconstruction
• Agent Supply Chain Security - Third-party agent governance
• Assessor Hot Sheet - Two-page printable for assessment meetings
• SDK Documentation - Python, TypeScript, and all SDK reference
• UCT Registry - Complete procedure catalog (266 procedures, 75 namespaces)
• Anchor Verifier - Verify any SWT3 Witness Anchor fingerprint