AGENTFORCE-AF-03: A2A Card Overpermissioned Scope
🔴 High · MuleSoft Agent Fabric
Detects A2A Agent Cards that advertise sensitive capabilities (database writes, deployments, payments) without requiring strong authentication (mTLS, OAuth2). Remote agents discovering this card at /.well-known/agent.json can invoke privileged operations without identity verification.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-03 |
| Severity | High |
| Category | MuleSoft Agent Fabric |
Remediation
Require mTLS or OAuth2 authentication on A2A cards that expose write, deploy, or payment operations. Update the authScheme in the agent card configuration.