Testing authority preservation across an upstream A2A → MCP tools/call boundary

[arjun2075]

I built a runnable fixture around a narrow composition question:

When an upstream agent has only bounded authority delegated by a human, what must remain true when the eventual operation reaches an MCP tools/call boundary?

The execution path is:

Human → Agent A → A2A Agent B → MCP → Tool

The current reference scenario is:

• Human authorizes Agent A to refund one specific order up to $25
• Agent A attenuates Agent B's delegated authority to $20
• Agent B requests $18 → allowed → refund_order executes
• Agent B widens the downstream MCP request to $22 → denied → zero tool side effects

The negative case is intentional: $22 remains within the human's original $25 ceiling, so an implementation that checks only the root authority would incorrectly allow it. The fixture instead requires the effective downstream authority to respect the narrower intermediate delegation.

The implementation now uses the official A2A and MCP Python SDKs over real network hops. Agent B receives the delegation evidence through the A2A boundary and carries the same logical chain into the MCP request. The repository includes 12 tests, machine-readable results, and an intentionally vulnerable mode that validates only the human root; in that mode the forbidden $22 refund executes and the conformance runner correctly reports failure.

This is not a proposed MCP field or authorization standard. The delegation representation and policy algorithm are fixture-local.

I also completed a prior-art review. Monotonic attenuation and chain-wide enforcement are established capability-security concepts (Macaroons, Biscuit, ZCAP-LD, UCAN). The useful question here is therefore narrower: how should that known security invariant be preserved when execution crosses from an upstream agent protocol into an MCP tool boundary?

I'd be especially interested in feedback from MCP authorization/security maintainers:

• Are there existing MCP test fixtures or patterns that cover authority narrowed by an upstream delegator before tools/call?
• Is there a preferred way to carry or bind such upstream authorization context without conflating it with MCP transport authentication?
• Are there existing proposals or implementations this fixture should test against?

Relevant Links

Repo: github.com/arjun2075/a2a-mcp-authority-conformance

Verified baseline tag: v0.1-conformance-baseline