A library/parks reservation agent hands off a booking to a separately hosted payment agent via A2A, and the requester's identity must carry through to the payment step. What must the handoff preserve for this to work correctly?

Identity propagation across an A2A handoff means the requester's principal identity travels with the request, so the receiving payment agent can authorize and act in the context of the actual requester rather than some other identity. Substituting the reservation agent's own service-account credentials breaks that chain — the payment agent would then be acting as the reservation agent, not the requester, which undermines any authorization or audit logic that depends on knowing who actually initiated the payment. Passing only the reservation ID and expecting the payment agent to independently look up the requester introduces an extra round-trip and a gap where the payment agent has to trust a separate lookup rather than a propagated, already-verified identity — it also assumes the payment agent has access to whatever system holds that mapping, which isn't guaranteed. Omitting identity entirely and relying on the original reservation agent to have already checked it ignores that the payment agent is a separate service making its own authorization decision; it can't safely assume upstream checks still apply once the request has left that agent's boundary. Scope note: this matters most whenever a handoff crosses an agent or service boundary that has its own independent authorization requirements. Operational check: inspect the payload the payment agent receives and confirm it carries the requester's identity, not a service identity, before it processes the charge.