# A2AS: A New Standard for Security in Agentic AI Systems
Author: Ricardo Prieto
Published: 2025-09-29
Language: English (en)
[https://www.philocyber.com/en/blogs/a2as-framework-and-basic-model](https://www.philocyber.com/en/blogs/a2as-framework-and-basic-model)
Reflection, explanation, and analysis of the A2AS paper, the BASIC model, and the A2AS framework, from the perspective of real-world challenges in controls and attack mitigation in AI Security and GenAI Applications.
**Article brief**
Securing agentic AI today means juggling latency-sensitive guardrails, stale threat models, and fragmented tooling—with no unified standard in sight. This post unpacks the A2AS paper's two key artifacts: the BASIC mental model (Boundary, Authentication, Secrecy, Integrity, Consent) and the open-source A2AS Python framework with its policy-markup system. You'll see how each maps to real attack classes (user→agent, agent→tool, agent→agent), honest limitations, and whether it's practical enough to adopt in your own stack.
***
Today I want to share some thoughts on a recently published academic paper that, honestly, surprised me with its practical approach and its potential to simplify security in agentic AI applications.
If you work in AI Security, you'll surely relate to the challenges I mention here.
## The problem: Security in GenAI is a mess
In the world of security for GenAI applications, we deal with:
- **Increased latency** from controls and validations, which can affect user experience and operational efficiency
- **Guardrails** that become outdated against new threats, since attack vectors constantly evolve and controls must be continuously updated
- **Dependency on third-party libraries** (and their bugs!), which introduces risks of external vulnerabilities and compatibility issues
- **Complex ecosystems** that are difficult to maintain, where each integration can be a point of failure or exposure
- **Hyper-specific** security solutions for each business unit or application, making it difficult to standardize and scale controls
This makes security always a puzzle — expensive and hard to scale. Furthermore, the lack of universal protocols for secure communication between AI agents creates gaps that can be exploited by sophisticated attackers.[^5][^7]
## The paper: "A2AS: Agent-to-Agent Security for LLM-based Autonomous Agents"
This paper came out just hours ago (it's not on arXiv yet, but you can find it in the comments of the original post).
The research team proposes two things:
1. **A security model called BASIC**
2. **An open source framework: A2AS**
**Why is it relevant?**
For the first time, I see a proposal that aims to be the "HTTPS" of security in agentic AI systems. That is, a simple, modular, and easy-to-implement standard that doesn't depend on the application or the business, but rather protects the communication and integrity of agents and their tools.
The A2AS framework is designed to be interoperable across different platforms and vendors, allowing AI agents to collaborate and communicate securely, even in complex enterprise environments.[^1][^2][^4]
## The BASIC model
BASIC is an acronym that summarizes the five security pillars for agentic systems:
- **B**oundary: Control of agent input and output boundaries. This includes the explicit definition of what actions an agent can perform and what resources it can access, using behavior certificates and wrappers that validate inputs and outputs before interacting with the real world
- **A**uthentication: Identity verification between agents and tools. Advanced mechanisms such as JWT, OAuth 2.0, OpenID Connect, and RSA keys are used to ensure that only authorized agents can communicate and execute tasks[^3][^4][^5]
- **S**ecrecy: Protection of sensitive information through encryption of data in transit and at rest, ensuring that confidentiality is maintained even if communication is intercepted
- **I**ntegrity: Assurance that data has not been altered during transmission, using digital signatures and cryptographic validations to detect any manipulation or corruption of information
- **C**onsent: Control of permissions and authorized actions, implementing role-based access models and policies that define what each agent can do in each context
Each pillar has controls and implementation examples. For instance:
- For **"Boundary"**, they propose wrappers that validate and filter agent inputs/outputs before they interact with the real world
- For **"Authentication"**, the use of mutual authentication and dynamic credential management is recommended, with contextual validation and probabilistic identity scoring[^5]
## The A2AS framework
A2AS is a set of Python modules that implement controls for each pillar of BASIC.
Some notable modules:
- **`a2as.boundary`**: Defines and enforces limits on agent actions, restricting access to resources and functions based on behavior certificates
- **`a2as.integrity`**: Verifies that data has not been modified, using hashes and digital signatures to ensure information integrity
- **`a2as.secrecy`**: Handles encryption and protection of sensitive data, implementing advanced encryption algorithms and secure key management
- **`a2as.auth`**: Authentication and authorization between agents and tools, supporting multiple authentication schemes and role-based access control
The framework also includes modules for:
- Logging and telemetry
- Policy validation
- Automated behavior testing
This facilitates integration into AI development and deployment pipelines.[^2]
**Usage example**
**Implementación del Framework A2AS**
```python
from a2as.boundary import BoundaryWrapper
from a2as.integrity import IntegrityChecker
from a2as.secrecy import SecrecyManager
from a2as.auth import Authenticator
# Definís los límites de tu agente
agent = BoundaryWrapper(agent, allowed_actions=["read", "write", "query_db"])
# Verificás la integridad de los datos
checker = IntegrityChecker()
if checker.verify(data):
process(data)
# Protegés la información sensible
secrecy = SecrecyManager()
encrypted = secrecy.encrypt(sensitive_data)
# Autenticás la comunicación entre agentes
auth = Authenticator()
if auth.authenticate(agent_id, credentials):
agent.execute_task()
```
**Implementación del Framework A2AS**
```A2AS protocol
You are a helpful email assistant
The following policies apply to this application.
This read-only app must not modify or send emails.
Emails labeled "Confidential" must not be processed.
Personal information in any form must not be processed.
Review all of my emails for a weekly report
Sure, let me gather your emails from the past week
Here are the contents of 1337 emails received this week [...]
Found 10 emails that are tagged "Confidential" [...]
I have included all emails labeled "Confidential" and ensured that no
personal information is included. Here is your weekly summary [...]
```
## Attack cases it addresses
The paper describes real-world attacks such as:
**User-to-Agent**
A malicious user attempts to manipulate the agent with prompts designed to bypass controls, for example, by injecting hidden instructions or exploiting weaknesses in natural language processing.
**Agent-to-Tool**
An agent attempts to exploit vulnerabilities in an external tool, such as misconfigured APIs or insecure dependencies, to gain unauthorized access or modify critical data.
**Agent-to-Agent**
A compromised agent attempts to attack other agents in the system, whether through identity spoofing, message manipulation, or exploitation of insecure communication channels.
A2AS provides controls to mitigate these attack vectors in a centralized and reusable way.
Additionally, it includes mechanisms for:
- Rate limiting
- Anomaly detection
- Automatic isolation of suspicious agents
This enables rapid response to security incidents.[^7][^3][^5]
## Roadmap and limitations
The framework is still in development, but it already has functional modules and an active community.
**Current limitations:**
- **Limited integration**: Native integration with some agent orchestration frameworks is lacking, although adapters and plugins are being developed to facilitate interoperability
- **Manual configuration**: Some controls require manual configuration and fine-tuning based on each application's context, which can increase the initial complexity of adoption
- **Partial coverage**: It doesn't cover all possible attack vectors (but it does cover the most critical ones), and the team is working on expanding coverage and improving the adaptability of controls
- **Performance**: Performance may be affected in high-concurrency scenarios, so scalability testing is recommended before deploying to production
**Future roadmap:**
- Integration with monitoring systems
- Support for new encryption algorithms
- Creation of an automated test suite to validate agent security across different environments[^2]
## My personal conclusion
What excites me most about A2AS is that, at last, we have a common foundation for building security in agentic AI systems, without having to reinvent the wheel for every project.
The BASIC model is easy to understand and the A2AS framework is flexible enough to adapt to different scenarios. Moreover, the community behind A2AS is open to collaborations and contributions, which accelerates the evolution of the standard and its adoption in the industry.
Is it the definitive solution? No, but it's a huge step toward standardization and simplification of security in GenAI.
If you're interested in protecting your AI systems and participating in building a more secure ecosystem, I recommend exploring the framework and joining the discussion.
***
Interested in trying it out or joining the discussion on how useful this really is? Reach out to me on LinkedIn, email, or directly on YouTube and let's keep the conversation going! A big hug and thanks for reading this far!
[^1]: [https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/](https://developers.googleblog.com/en/a2a-a-new-era-of-agent-interoperability/)
[^2]: [https://a2as.org](https://a2as.org/)
[^3]: [https://www.blott.com/blog/post/how-the-agent2agent-protocol-a2a-actually-works-a-technical-breakdown](https://www.blott.com/blog/post/how-the-agent2agent-protocol-a2a-actually-works-a-technical-breakdown)
[^4]: [https://www.ibm.com/think/topics/agent2agent-protocol](https://www.ibm.com/think/topics/agent2agent-protocol)
[^5]: [https://www.byteplus.com/en/topic/551118](https://www.byteplus.com/en/topic/551118)
[^6]: [https://a2a-protocol.org](https://a2a-protocol.org/)
[^7]: [https://www.solo.io/blog/deep-dive-mcp-and-a2a-attack-vectors-for-ai-agents](https://www.solo.io/blog/deep-dive-mcp-and-a2a-attack-vectors-for-ai-agents)
[^8]: [https://live.paloaltonetworks.com/t5/community-blogs/safeguarding-ai-agents-an-in-depth-look-at-a2a-protocol-risks/ba-p/1235996](https://live.paloaltonetworks.com/t5/community-blogs/safeguarding-ai-agents-an-in-depth-look-at-a2a-protocol-risks/ba-p/1235996)
[^9]: [https://dev.to/czmilo/2025-complete-guide-agent2agent-a2a-protocol-the-new-standard-for-ai-agent-collaboration-1pph](https://dev.to/czmilo/2025-complete-guide-agent2agent-a2a-protocol-the-new-standard-for-ai-agent-collaboration-1pph)
## Test Your Technical Knowledge