In a multi-agent pipeline, an orchestrator sends tasks to sub-agents and processes their responses. Most current implementations authenticate the orchestrator to the sub-agent (proving the caller has the right API key) — but don't authenticate the sub-agent back to the orchestrator.

This one-directional trust means an attacker who can intercept or impersonate a sub-agent's response can inject malicious data into the orchestrator's context. The orchestrator has no way to verify the response came from the real sub-agent.

Mutual TLS requires both sides of a connection to present valid certificates. The orchestrator proves its identity to the sub-agent, and the sub-agent proves its identity to the orchestrator. A forged or intercepted response from a different server will fail certificate verification.

mTLS is already used in service mesh architectures (Istio, Envoy) for microservice-to-microservice authentication. The same pattern applies to agent-to-agent communication — the agent infrastructure needs to treat every A2A connection as a service-to-service connection with mutual authentication requirements.

Agent cards — the metadata documents agents use to discover and connect to each other — should be signed with a private key whose public key is published in a trusted PKI. An agent receiving a card verifies the signature before using the card's endpoint information.

A forged agent card without the legitimate agent's private key will fail signature verification, blocking the agent-in-the-middle scenario (Scenario 6).