A2A & remote agents
Kaizen can exchange work with agents that run outside it, using the A2A agent-to-agent protocol. This is a proof of concept intended for isolated deployments — read this page before enabling it anywhere else.
What it is
With A2A enabled, Kaizen can:
- publish an agent card describing an agent it hosts, at
/api/a2a/v1/agents/{agent_id}/.well-known/agent-card.json; - receive a task from an external agent at
/api/a2a/v1/agents/{agent_id}; - dispatch a selected turn to a registered remote agent using the A2A protocol instead of the internal runtime transport.
The receiving agent can use any runtime. Kaizen's internal runtime remains a private implementation detail rather than part of the contract.
A card is not a permission
This is the single most important property.
An Agent Card or remote skill descriptor is a capability description. It advertises what an agent claims it can do. It grants nothing.
- A remote response may propose work; it cannot approve it.
- An inbound A2A task may pause in an authorization-required state; that state is not consent.
- Execution still stops at Kaizen's existing member approval gate.
Kaizen applies member, workroom, managed-registration, and task-policy checks separately from anything the card says. Remote agents are treated as untrusted input, exactly like connector content.
Flags
| Flag | Default | Gates |
|---|---|---|
KAIZEN_A2A_POC_ENABLED | off | The whole feature |
KAIZEN_A2A_DISCOVERY_ENABLED | off | Serving agent cards |
KAIZEN_A2A_INBOUND_ENABLED | off | Accepting tasks from outside |
KAIZEN_A2A_OUTBOUND_ENABLED | off | Registering remote agents |
KAIZEN_A2A_SEND_ENABLED | off | Dispatching turns to them |
Every flag ships off. With the master switch off the agent card is not served and the adapter answers 404, so an untouched deployment has no A2A surface at all.
Administration lives under /api/ops/a2a: validate configuration, set the
public base URL, rotate the shared secret, and manage inbound agents. Per-agent
A2A settings and keys are managed on the agent itself.
Because these are separate flags, an operator can serve discovery without accepting inbound tasks, or register remote agents without publishing anything — which is the right posture for most evaluations.
Dispatch still goes through the runtime interface
When a turn targets a managed remote agent, Kaizen dispatches through the same agent-runtime interface it uses for local agents. Only the transport changes.
That means a remote turn still gets:
- the same authority bundle,
- the same guardrails and budgets,
- the same journal and terminal-outcome guarantees,
- the same audit trail.
Remote cards describe skills and media modes; they do not alter any of the above.
Inbound safety
An inbound task arrives from outside the deployment's trust boundary. Kaizen:
- authenticates the caller against managed registration and the shared secret;
- resolves the target agent and re-checks it is registered for inbound use;
- treats the payload as untrusted content, never as identity or authority;
- refuses to let an inbound request select a member, a role, or an approval.
An inbound task that requires an authorization decision waits; it does not proceed on the assumption that the sender was entitled to ask.
Deployment guidance
Enable A2A when:
- the deployment is isolated, and
- both ends are operated by the same organization, and
- you are evaluating the protocol rather than depending on it.
Remote agent endpoints in a Kamiwaza deployment must use HTTPS. The catalog does not expose the process-local HTTP exception used by isolated development tests.
Do not enable inbound A2A on a deployment reachable from an untrusted network without an independent authentication layer in front of it. The shared secret is a proof-of-concept control, not a substitute for network policy.
Current limitations
- It is a proof of concept. Interfaces may change.
- Approval semantics across the boundary are deliberately conservative: anything requiring confirmation denies rather than assuming consent.
- Remote agents cannot be scheduled as task targets; scheduled definitions accept saved prompts and prompt chains only.