A2A task and tenant crossover

A2A request identity binding tenant partition 25–35 minutes

Two synthetic tenants own separate controlled records. The exercise tests whether tenant, task, and actor context stay bound as work crosses an A2A delegation boundary.

Recipe	Value
Pause	tenant-alpha SendMessage request
Attack	tenantId → tenant-beta, or substitute the other task ID
Control	change only metadata.label
Receiver proof	tenant-partitioned specialist state
Out-of-band proof	controlled access ledger

Gateway
tenant-alpha AIT
rebind identity Specialist
selects record Tenant store
alpha / beta Access
ledger

Start and inspect the baseline

ait lab start --exercise a2a-identity-crossover

Trigger the exercise and inspect the request before editing. Confirm that the sender, task, and tenant values all describe tenant-alpha. Record those values; the point of the exercise is their relationship, not a single isolated key.

Run the tenant attack

1. Select the pending SendMessage request.
2. Change /params/message/metadata/tenantId from tenant-alpha to tenant-beta.
3. Mark the message as the attack arm and forward it.
4. Inspect which tenant record appears in specialist state.
5. Inspect the access ledger for the tenant, task, and actor it recorded.

An access row for tenant-beta is the controlled proof. A diff showing the new string is only delivery evidence.

Run the task variant

Reset for a fresh comparison only after completing the attack/control pair. Then rerun the exercise and substitute the other synthetic task ID while leaving the tenant claim intact. This asks whether task ownership is verified independently or inferred from the request.

Keep the tenant and task variants as separate observations. If both move the same record, they may share a root cause, but the wire conditions are different.

Run the close control

Trigger the original tenant-alpha request again in the same session. Change only metadata.label and mark the message as the control arm. The label is nearby, serialized, and visible to the receiver, but it does not claim tenant authority.

Result	Interpretation
attack reads tenant-beta; control reads tenant-alpha	crossover isolated in this fixture
both read tenant-beta	session state or another mutation may be driving the result
neither reaches the receiver	inspect delivery and pending decisions first
receiver state moves but access ledger does not	stop below out-of-band effect observation

Evidence boundary

This exercise proves a crossover only in the controlled target when receiver state and access ledger agree. It does not show that arbitrary A2A servers accept caller-supplied tenant claims. A production assessment needs the target's real partition boundary and a safe record selected for the test.

The correct control is an identity-adjacent non-authoritative field. Changing message prose is weaker because it does not resemble the field whose binding is under test.

Done when

You can reconstruct which tenant the sender intended, which values crossed the wire, which record the receiver consumed, and which separate ledger entry recorded the access.

Next: Agent Card substitution changes the receiver endpoint rather than the identity inside the request.