Agent

Authorization down to call arguments really does work. It costs about 20ms per response and the default deployment tops out around 100 requests per second, and one iteration-count setting turns out to own that cost. Writing the condition the way the documentation shows leaves tools/list returning nothing, so an agent finds no tools at all: wrap the CEL in has().

What A2A gives you is a contract for progress and cancellation. What it costs is a larger response (seven times plain HTTP for the same job) and 1.2 to 2.1 ms more per call. The authentication the agent card declares is not enforced by the SDK’s default setup, so read declaration and enforcement separately.