AAIF

Native support does not mean the workaround has to go. The documented pitfalls, plus 80 runs from the July extension study, decide what to keep and what to fix.

Authorization down to call arguments really does work. It costs about 20ms per response and the default deployment tops out around 100 requests per second, and one iteration-count setting turns out to own that cost. Writing the condition the way the documentation shows leaves tools/list returning nothing, so an agent finds no tools at all: wrap the CEL in has().

What A2A gives you is a contract for progress and cancellation. What it costs is a larger response (seven times plain HTTP for the same job) and 1.2 to 2.1 ms more per call. The authentication the agent card declares is not enforced by the SDK’s default setup, so read declaration and enforcement separately.

The gateway hop costs under 1 ms per tool call and never improves p99, and in return you get control and observation the server cannot do on its own. One argument-conditioned policy was accepted and still did not enforce what it said, so turn a policy on and then check it with real calls.

Porting the transport to the v2 SDK is mostly a version bump. The real migration is deciding where handle state lives, and leaving it in pod memory brings the old failure back behind an HTTP 200 that transport retries never see.

The two AGENTS.md migration workarounds (import, symlink) were measured on Kubernetes incident-response tasks: no penalty in speed or context-load tokens; deltas moved with the symlink control, marking them as run variance.