SNOW-AF-10: A2A Agent Card Without a Security Scheme
🟡 Medium · ServiceNow Action Fabric
Detects a ServiceNow A2A agent card that advertises no security scheme. Medium by default, high when the agent can write a system of record, low when a connection in the same update set already has authentication (the card and the connection disagree).
Details
| Field | Value |
|---|---|
| Rule ID | SNOW-AF-10 |
| Severity | Medium |
| Category | ServiceNow Action Fabric |
Remediation
Declare a security scheme on the agent card (OAuth or an ACL that is not Public) that matches the authentication on the connection callers actually use.