Agent Cards: How Your Company Gets Found When the Buyers Are Machines

Every era of commerce has had a listing that decided who got found. The phone book. The trade directory. The website. The online catalog. The agent economy has one too, and most industrial businesses have never heard of it.

It is called an Agent Card, and it is part of the Agent2Agent (A2A) protocol, the open standard, now governed by the Agentic AI Foundation under the Linux Foundation, for how AI agents from different companies discover each other and transact.

What an Agent Card is

An Agent Card is a small JSON document published at a standard, well-known address on your company's domain. Think of it as a machine-readable business card. When a purchasing agent, a partner's system, or a future customer's AI goes looking for suppliers, the card is what it reads. It declares:

• Who you are. Your organization, described in a way software can verify.
• What you can do. Your capabilities and skills: quote requests, spec lookups, availability checks, order status, whatever you choose to expose.
• How to talk to you. The endpoints and protocol bindings your systems answer on.
• How to authenticate. The security schemes a counterparty must use, from API keys to OAuth to mutual TLS.
• That it is really you. Since the v1.0 specification (March 2026), Agent Cards can be cryptographically signed, so a counterparty can tell your card from a forgery.

That last point deserves more attention than it gets. Security researchers have documented Agent Card spoofing as a real risk, and signing, while supported by the specification, is not yet enforced or widely practiced. Publishing a card without proper signing and authentication is like putting a phone number in the book that anyone can answer.

What publishing one properly involves

Writing the JSON is the easy part. The work that makes an Agent Card worth publishing sits underneath it:

Deciding what to expose. Which products, specs, prices, and capabilities should outside agents see? That is a business decision about your competitive information, not a technical formality. It deserves the same care you give a distributor agreement.

Answering with real data. An agent that quotes from a stale spreadsheet is worse than no agent at all. The endpoint behind the card has to draw on your actual catalog, inventory, and lead times, which means connecting the systems that hold them.

Keeping a human in the loop first. The sensible first deployment answers questions and drafts quotes with a person approving each response, until the data and the guardrails have earned autonomy.

Getting the security right. Signed card, authenticated endpoint, audit trail. The early agent economy will have forgeries and probes, and the businesses that implement properly will be the ones counterparties learn to trust.

The timing question

Is it too early? Honest answer: the buyer side is moving first. Deloitte's June 2026 research found 40 percent of B2B buyers already using agentic AI in purchasing while only 11 percent of suppliers have agents in production. Production machine-to-machine commerce in industrial markets is still young, and anyone claiming otherwise is overselling.

But the standard is stable, the platforms speak it, and the cost of being ready is a scoped project, not a transformation program. When the first agent-mediated RFQ in your market goes out, the shortlist will be the companies whose cards were already published. That listing is being written now.

Sources: A2A protocol specification v1.0 and agent discovery documentation (a2a-protocol.org, March 2026); Agentic AI Foundation announcement (August 2026); Deloitte, "B2B agentic commerce" (June 2026); Palo Alto Networks analysis of A2A protocol risks (2025).