Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Add multi-tenant hosting hosting security consideration to a2a sample
2026-07-07 17:10:13 -07:00 · 2026-07-07 16:32:49 -07:00
1 changed files with 13 additions and 0 deletions
@@ -79,3 +79,16 @@ cd python/samples/02-agents/a2a
 $env:A2A_AGENT_HOST = "http://localhost:5001/"
 uv run python agent_with_a2a.py
 ```
+
+## Security considerations for multi-tenant hosting
+
+The default `a2a-sdk` task/push-config stores scope ownership by `user_name` only. **Any host that mounts tenant-bearing routes must pass a tenant-aware `owner_resolver`** to the stores, e.g.:
+
+```python
+from a2a.server.tasks import InMemoryTaskStore
+
+def resolve_tenant_user_scope(context):
+    # Derive tenant + user identity from your host's auth/session context.
+    return f"{context.tenant}:{context.user.user_name}"
+task_store = InMemoryTaskStore(owner_resolver=resolve_tenant_user_scope)
+```
Author	SHA1	Message	Date
Tao Chen	40a6bd84e7	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 17:10:13 -07:00
Tao Chen	4965a3424e	Add multi-tenant hosting hosting security consideration to a2a sample	2026-07-07 16:32:49 -07:00