Trust boundaries in the kit Six rows, one per place where data crosses between parties in the kit, shown in the order the planner meets them. Agent card: a spoofed card sends messages elsewhere, so the planner verifies signatures over HTTPS. Parts in replies such as review.json: text written as orders, so the planner validates data parts and decides on typed fields. File and URL parts: bad files, or an agent that fetches any URL it is given, so the agent checks type, size, and URLs. Webhook URL: SSRF, so the agent rejects private hosts. Incoming notifications: forgery, so the planner checks Authorization and the task id. Stored records: secrets kept in clear, so agents redact, scope reads, and set retention. WHERE DATA CROSSES THREAT CHECK the planner checks the remote agent checks agent card /.well-known/agent-card.json spoofed card messages go to its endpoint verify signatures kid deployer-key-1, HTTPS parts in replies review.json, test-log.txt injected orders text that reads as orders validate data parts decide on typed fields file and URL parts refunds.diff, screenshot.png bad files, SSRF the agent fetches any URL check type and size validate URLs first webhook URL localhost:41250/a2a-events SSRF posts to internal hosts reject private hosts or keep an allowlist POST /a2a-events a notification arrives forged notification acts on a fake event check Authorization and that taskId is yours stored records history, configs, logs secrets kept in clear hook_secret_91d2 echoed redact, scope reads set a retention policy