From the card to an enforced request and an in-task approval
Five steps for the deployer agent. Step one: the card declares a bearer scheme and requires it, and the platform team issues a token outside A2A. Step two: GetExtendedAgentCard without a token gets HTTP 401 with a WWW-Authenticate challenge. Step three: the same call with the token gets the extended card with a rollback skill. Step four: a streamed deploy with the token stops the task in TASK_STATE_AUTH_REQUIRED. Step five: an operator approves at the deployer outside A2A and the task works and completes on the same stream.
1 · THE CARD DECLARES, THE CLIENT OBTAINS
2 · HTTP CHECKS BEFORE ANY A2A METHOD RUNS
3 · THE TASK ASKS FOR MORE, OUTSIDE A2A
deployer card
securitySchemes: bearer
httpAuthSecurityScheme, Bearer
securityRequirements: bearer
platform team
issues the token dpl_test_7c1e4b
outside A2A, before any request
GetExtendedAgentCard
no Authorization header
HTTP 401 Unauthorized
WWW-Authenticate: Bearer realm="deployer"
refused
GetExtendedAgentCard
Authorization: Bearer
dpl_test_7c1e4b
200 OK, extended card
one more skill: rollback
shown only to authenticated callers
accepted
SendStreamingMessage
Deploy build 2026.10.06-1
to staging, with the token
TASK_STATE_AUTH_REQUIRED
task ecf2dcb6 waits, stream open
an operator must approve
deploy
operator approves
POST /approve/ecf2dcb6
at the deployer, not in A2A
TASK_STATE_COMPLETED
after TASK_STATE_WORKING
on the same stream
the approval link
resumes