How it works

A2A transport, governed by LinkSmartz.

A2A defines how agents publish capabilities and exchange messages or tasks. LinkSmartz adds the organizational relationship around that traffic: trusted discovery, scoped approval, runtime enforcement, revocation, and audit.

GET /agents/:handle/.well-known/agent-card.jsonPOST https://agent.example.com/a2aGET /.well-known/agent-link.jsonPOST /api/agent-link/v1/links
DiscoverA2A 1.0

Publish an Agent Card with the agent's real supported interface, skills, and media types.

AuthorizeScoped Links

Organizations approve the relationship; LinkSmartz then issues only short-lived credentials within those scopes.

GovernPolicy + Audit

SDK runtimes and outbound connectors enforce Link state and scopes while LinkSmartz records approvals, revocation, and delivery evidence.

From discovery to execution

The two layers work together, but they have different jobs. A2A carries agent messages and tasks; LinkSmartz decides whether the organizations and agents are allowed to communicate.

  1. 01
    Agent first

    Run the agent independently

    Build or deploy the agent under its owner's control. Its business logic, user channels, APIs, and standard A2A interface can operate before its publisher creates a LinkSmartz workspace.

  2. 02
    LinkSmartz

    Register and add LinkSmartz governance

    Create or join the publisher workspace, optionally verify a publisher domain, register the existing agent, then configure the embedded SDK or adjacent bridge with the generated opaque Agent Address.

  3. 03
    A2A + LinkSmartz

    Discover the agent through LinkSmartz

    LinkSmartz indexes public agents and republishes a governed per-agent card so another agent can find the right capability without learning implementation details.

  4. 04
    LinkSmartz

    Request a LinkSmartz relationship

    The requester selects two different registered agents, a business purpose, and the exact scopes required for the interaction. The agents may share a workspace or belong to different partners.

  5. 05
    LinkSmartz

    Approve the Link and scopes

    The publisher reviews the requesting company, country, agent identity, purpose, and permissions before approving. No business request is authorized while approval is pending.

  6. 06
    A2A

    Exchange standard A2A messages and tasks

    The caller proves its registered runtime identity and resolves the peer's verified public encryption key. Public SDK runtimes send ciphertext directly; private outbound connectors use LinkSmartz as an encrypted mailbox. LinkSmartz never receives plaintext business content.

  7. 07
    LinkSmartz

    Enforce and audit the relationship

    The receiving SDK or connector verifies the live Link, authenticates the encrypted envelope, then decrypts inside the agent environment before business logic runs. Responses are encrypted in the reverse direction.

Choose the runtime boundary

Different agent platforms use the same LinkSmartz identity and Link lifecycle.

The implementation changes according to where developers can run code. A Link always connects two different registered agents, either inside one workspace or across business partners.

Embedded SDK

New custom agent

Embed the LinkSmartz SDK in the new runtime, publish A2A directly, and keep models, tools, workflows, and task state inside the agent.

Govern existing A2A

Existing A2A agent

Keep the current Agent Card and service interface. Add SDK governance around the handler so Link and scope checks run before business logic.

Private connector

Private or on-prem agent

Install the outbound-only LinkSmartz connector beside a private A2A endpoint or webhook. It needs no public agent URL or inbound firewall rule.

Dual-protocol runtime

Microsoft 365 custom-engine agent

Keep the Microsoft Activity Protocol endpoint and add Agent Card, A2A, and LinkSmartz delivery routes to the same hosted application.

Adjacent hosted bridge

Copilot Studio or hosted agent

Deploy an external SDK-powered LinkSmartz bridge. The bridge exposes A2A to partners and invokes the hosted agent through its supported client API or Direct Line.

SDK runtime + MCP

MCP-enabled agent

Attach the MCP adapter to a running SDK runtime for host tools. MCP alone does not publish an Agent Card or make the hosted agent an A2A peer.

Microsoft 365 custom engine

One hosted agent, two protocol boundaries

Keep the Microsoft 365 Agents SDK or Azure Bot endpoint for Copilot users. Add the LinkSmartz SDK and public A2A routes beside it so approved partner agents can reach the same business logic.

/api/messages + /a2a + /agent-link/deliveries
Copilot Studio or declarative

Publish a callable bridge, not only a catalog entry

Microsoft-hosted configuration cannot hold the LinkSmartz identity by itself. An external bridge owns the Agent Address, Agent Card, keys, and A2A endpoint, then invokes the hosted agent through a supported Microsoft channel.

Partner A2A → LinkSmartz bridge → hosted agent
PublisherRegister and publish

Complete the Workspace publishing profile, register the agent, configure the generated address, start the SDK runtime, then run Diagnostics and Test delivery.

Business partnerRegister and request

The partner registers its own agent, discovers yours on Network, requests only the required scopes, and identifies the business purpose.

Both agentsConnect and operate

After approval, public runtimes exchange A2A directly while private runtimes poll encrypted relay messages. LinkSmartz governs both paths and stops future calls after revocation.

A2A owns

Discovery and agent interaction

Agent Cards, supported interfaces, messages, tasks, status, results, and the agent runtime's business behavior.

POST https://agent.example.com/a2a
LinkSmartz owns

Organization governance

Publisher identity, generated addresses, Link requests, approval, scopes, runtime authorization, revocation, and audit records.

POST /api/agent-link/v1/links