A water utility requires an agent policy step that validates a calling agent's identity before granting cross-department sensor access over A2A. Where must that validation apply for the design to be effective?

For identity validation to actually secure cross-department access, it has to gate every A2A call that requests it, because each such call is a separate access event that could come from a different calling agent with different privileges — checking only the original user-facing request leaves every subsequent internal handoff unguarded. Validating only at the initial human-submitted request assumes that everything downstream inherits the same trust level automatically, which isn't a safe assumption once multiple agents and departments are involved in a chain of handoffs. Validating only during deployment review checks an agent's configuration at one point in time but says nothing about what identity is actually making a given call later — deployment-time review and runtime enforcement are different controls, and skipping the latter leaves a gap between what was reviewed and what's actually enforced when calls happen. Restricting the check to agents originating outside the utility's own department assumes internal agents are inherently trustworthy, which undermines the point of per-agent identity validation — a compromised or misconfigured internal agent can request cross-department access just as an external one could. Scope note: this pattern generalizes to any workflow where a single initial authorization shouldn't be treated as blanket trust for every downstream call. Operational check: trace an A2A call chain that crosses two departments and confirm the identity check fires on the cross-department hop itself, not only at the very start of the chain.