Answering other agents: A2A for a small business

The conversation, in plain terms

Another agent reads your card, picks a skill, and sends a message to the endpoint the card names. In A2A 1.0 the JSON-RPC method is SendMessage. Your agent replies with a task: a record of the request with a state such as completed, failed, input required, or working.

For a small business, most requests finish immediately: a question answered, a quote range returned, a booking request received. Those can be answered synchronously, and the card can say that the agent does not stream or push updates.

Use "input required" instead of guessing

When a request is missing something, such as a date, a service, or the person's consent to be emailed, the right reply is a task in the input-required state that says exactly what is missing. It is the protocol's way of asking a clarifying question, and it prevents the worst failure: an agent inventing the missing detail.

Protect the endpoint like a public form

An A2A endpoint is a public write path. Limit request size, rate-limit by client, validate every field, and log what was requested. If a skill should only be available to known partners, declare an authentication scheme in the card and require it; the specification supports API keys, HTTP authentication, and OAuth among others.

Never let a skill do something irreversible on the strength of one message. The same rule as the website: the agent requests, a person or a clear business rule confirms.