AGENTFORCE-AF-03: A2A Card Overpermissioned Scope

🔴 High · MuleSoft Agent Fabric

Detects A2A Agent Cards that advertise sensitive capabilities (database writes, deployments, payments) without requiring strong authentication (mTLS, OAuth2). Remote agents discovering this card at /.well-known/agent.json can invoke privileged operations without identity verification.

Details

Field	Value
Rule ID	AGENTFORCE-AF-03
Severity	High
Category	MuleSoft Agent Fabric

Remediation

Refer to the SquireX documentation for remediation guidance specific to AGENTFORCE-AF-03.

See Also

• Rule catalog index
• SquireX scan documentation