Separate A2A Agent Card Advertising from Runtime Authority

The A2A Agent Card describes an agent's name, skills, URL, and authentication requirements. The Agent Card advertises skills from Hermes toolsets, and A2A_ADVERTISED_TOOLSETS can narrow what appears on the card. That setting controls disclosure; the official excerpt does not say it restricts runtime tool authority.

Official documentation: https://hermes-agent.nousresearch.com/docs/user-guide/messaging/a2a

Review advertisement and authority separately

A public card should reveal only what peers need for discovery. A live Hermes gateway session may still have broader tools, memory, and account access than the card lists. Restrict the profile itself with normal toolset, credential, approval, and data-boundary controls.

The reverse is also important: an advertised capability is not proof that the agent will succeed, that the caller is authorized to request every use of it, or that the result is trustworthy. Cards are peer-supplied metadata.

Hermes filters inbound peer text, blocks remote operator slash commands, redacts credential-shaped outbound strings, records exchanges, and caps ping-pong turns. These controls reduce risk but do not make an exposed high-authority profile safe by default.

Disclosure checklist

List the skills a remote peer genuinely needs to discover.
Restrict the Agent Card to that reviewed set.
Independently inventory the profile's enabled tools.
Review memory and context that inbound tasks can reach.
Keep secrets out of names, descriptions, and synthetic tests.
Confirm audit and anti-loop settings are active.

Common pitfalls

Using the advertised-toolsets setting as access control. It narrows card disclosure, not documented runtime authority.
Publishing internal tool names unnecessarily. Discovery should expose the minimum useful description.
Trusting another agent's card as evidence. Verify claims through harmless calls and independent sources.
Testing redaction with real credentials. Use obvious synthetic canaries instead.

Verification

Fetch the Agent Card and compare it with the intended public capability list. Separately inspect the profile's effective toolsets and approval mode. Use a synthetic credential-shaped canary to verify outbound redaction without risking a real secret, then confirm remote slash-command text is treated as untrusted input rather than operator control.