A school district's policy requires that a tutoring agent may invoke a grading agent only when the calling identity belongs to an authorized teacher-agent, not just any agent that knows the grading agent's capability. What does this scenario illustrate?
Select an answer to reveal the explanation.
Short Explanation
Finding a tool in the phone book doesn't mean you're allowed to call it — that's the distinction here. Discovering the grading agent's capability through the registry is one thing; being authorized to actually invoke it as a specific identity is a separate policy check layered on top.
Full Explanation
This scenario is about policy enforcement gating invocation on caller identity: the grading agent isn't just discoverable, it's guarded by a check that only lets an authorized teacher-agent identity actually invoke it, which is a distinct step from discovery. Agent Registry's job is discovery and publishing capability metadata — knowing an agent exists and what it can do — but discovery alone doesn't grant authorization to call it; that's a separate policy decision layered on top. MCP standardizes how a tool call is structured and executed once authorized, but the protocol itself isn't what decides whether a given caller's identity is permitted to make that call — that decision lives in the policy layer, not the calling interface. A2A defines the message format and semantics for agent-to-agent handoffs and can carry identity information along with the request, but carrying identity data isn't the same as enforcing an access decision based on it — enforcement requires a policy component evaluating that identity against a rule. Scope note: this pattern matters most where invocation of a sensitive action (like grading) needs a stronger authorization boundary than tool discoverability alone provides. Operational check: attempt to invoke the grading agent using a non-teacher identity in a test environment and confirm the policy layer rejects the call even though the capability is discoverable.