Add External A2A to the reference diagram#45
Conversation
📝 WalkthroughUpdates the reference-architecture documentation by adding an External A2A depiction, showing enterprise agents reaching out to externally hosted and managed agents. It refreshes the gateway-as-the-enforcement-layer narrative, including clearer and more consistently formatted coverage of the gateway behavior on each boundary (notably the “eastbound egress” path). The HR recruitment reference scenario is rewritten to use a standardized six-cell topology and a defined chain of authorities (candidate intake, workflow assessment/evaluation, and hiring-manager approval), explicitly incorporating an external SaaS HR assistant verification step via agent-to-agent interaction and delegation from the supervisor. The conclusion is adjusted to name the relevant cells and reaffirm that pipeline actions follow the intended ownership/approval/identity boundaries. WalkthroughThe document separates gateway egress filtering and extends equivalent protections to eastbound traffic. It revises the recruitment pipeline with three sequential authorities, an external SaaS HR assistant, updated cell responsibilities, and verification before approval-driven scheduling. The containment analysis covers scoped, short-lived access for a compromised SaaS agent and preserves the ATS advancement gate. The conclusion updates the reference cell inventory and authority-boundary wording. Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Candidate
participant IntakeCell
participant EvaluationCell
participant ExternalHRAgent
participant HiringManager
participant CalendarService
Candidate->>IntakeCell: Submit recruitment information
IntakeCell->>EvaluationCell: Forward candidate intake
EvaluationCell->>ExternalHRAgent: Request scoped verification
ExternalHRAgent-->>EvaluationCell: Return verification result
EvaluationCell->>HiringManager: Deliver recommendation
HiringManager->>CalendarService: Approve and schedule interview
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cells-as-the-containment-unit-for-gentic-systems.md`:
- Line 309: Update the first authority description in the pipeline sequence to
explicitly say “the candidate’s authority at intake,” preserving the rest of the
sentence and authority ordering unchanged.
- Around line 350-351: Revise the external SaaS agent containment paragraph to
clarify that it receives no raw downstream enterprise credential, only a scoped,
short-lived on-behalf-of assertion. State that the gateway validates the
assertion’s audience, subject, intent, scope, lifetime, and reuse policy before
allowing the verification step.
- Around line 309-310: Align the verification scope between the overview and the
request flow: either state that background/reference, employment/education, and
right-to-work checks all occur before approval and are recorded in the ATS, or
narrow the overview to only background and reference verification. Update both
the overview and the corresponding request-flow text consistently.
- Line 233: Update the eastbound filtering description near “Egress filtering”
and the corresponding Section 5.7 content to use the same edge-contract
controls: DLP, outbound redaction, and disallowed-destination blocking. Clarify
that these filters are required on eastbound paths alongside identity narrowing,
actor-chain updates, and quotas.
- Line 316: Align the topology inventory and all later references so they use
one consistent cell count, including whether the Security Cell is part of the
inventory. Standardize the cell names throughout the document, using one form
for the Interview Coordinator/Interview Coordination Worker and one form for
Employee Profile Mgt./Employee Profile, and update descriptions that reference
“the same seven cells” or the six-cell grouping accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 270658dd-8256-46bd-8d03-12765dd35620
⛔ Files ignored due to path filters (1)
media/media_agentic_systems/recruitement-pipeline-cell-topology.pngis excluded by!**/*.png
📒 Files selected for processing (1)
cells-as-the-containment-unit-for-gentic-systems.md
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cells-as-the-containment-unit-for-gentic-systems.md`:
- Line 346: Revise the supervisor-compromise paragraph to distinguish
candidate-authority intake writes from workflow-authority verification and
workflow-record writes. Clarify that only candidate-scoped intake actions use
the candidate token, while verification or workflow state updates use the
workflow authority, and preserve the existing statements about no
cross-candidate access and approval delegation.
- Line 330: Update the external verification flow described in the supervisor
sequence to validate returned SaaS results before writing them to the ATS or
using them for approval. Bind each result to the intended candidate and request,
preserve provenance and verification status, and prevent unvalidated or
mismatched data from entering the candidate record or approval context.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9eb435c9-56ef-4ffd-b204-4009729726e3
📒 Files selected for processing (1)
cells-as-the-containment-unit-for-gentic-systems.md
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
cells-as-the-containment-unit-for-gentic-systems.md (1)
346-346:⚠️ Potential issue | 🟠 MajorSeparate candidate authority from workflow authority.
This still says all supervisor writes are rooted in the candidate token, while assessment, verification, and workflow records belong to the workflow authority. Clarify that candidate authority is limited to intake, with workflow-authority assertions used for subsequent records and state transitions, while retaining subject binding.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cells-as-the-containment-unit-for-gentic-systems.md` at line 346, Revise the supervisor-compromise paragraph to distinguish candidate authority from workflow authority: limit the candidate token to intake, and state that assessment, verification, workflow records, and state transitions use workflow-authority assertions. Preserve subject binding and the existing claims about no cross-candidate access or read scope.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cells-as-the-containment-unit-for-gentic-systems.md`:
- Line 309: Update the paragraph describing delegation to the external HR
assistant agent to explicitly classify it as southbound egress via the
southbound gateway contract. State that the delegation applies endpoint
controls, credential mediation, DLP, redaction, and destination filtering, while
keeping the guidance concise and high-level.
- Line 309: The verification flow must validate external HR assistant results
before they enter the ATS or approval context. Update the verification
delegation and downstream persistence described in the pipeline to require
candidate/request binding, trusted provenance, and an explicit successful
verification status, rejecting or quarantining results that fail validation
before ATS updates or approval decisions.
---
Duplicate comments:
In `@cells-as-the-containment-unit-for-gentic-systems.md`:
- Line 346: Revise the supervisor-compromise paragraph to distinguish candidate
authority from workflow authority: limit the candidate token to intake, and
state that assessment, verification, workflow records, and state transitions use
workflow-authority assertions. Preserve subject binding and the existing claims
about no cross-candidate access or read scope.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9fb72f4e-7942-4a2e-a347-b436d0bc286e
⛔ Files ignored due to path filters (1)
media/media_agentic_systems/recruitement-pipeline-cell-topology.pngis excluded by!**/*.png
📒 Files selected for processing (1)
cells-as-the-containment-unit-for-gentic-systems.md
| The system is a recruitment pipeline in the HR landscape used throughout this paper. A candidate uploads a CV against an open requisition; the pipeline assesses it against the requisition and its rubric, prepares tailored questions, and evaluates the answers into a structured recommendation. The candidate advances to a panel interview only after the hiring manager approves that specific candidate; only then are interviews scheduled and the outcome sent. | ||
|
|
||
| The pipeline runs under three authorities in sequence: the candidate's at intake, the workflow's own for assessment and evaluation, and the hiring manager's, minted at approval, for the advance and scheduling. It lands in a brownfield landscape: the applicant tracking system and the employee profile services are exposed to agents as governed tools and are not modified. Model selection, prompt design, and agent evaluation are out of scope; this section is about where the boundaries sit and what they enforce. | ||
| The pipeline runs under three authorities in sequence: the candidate's authority at intake, the workflow's own for assessment and evaluation, and the hiring manager's, minted at approval, for the advance and scheduling. It lands in a brownfield landscape: the applicant tracking system and the employee profile services are exposed to agents as governed tools and are not modified. Background and reference verification, employment and education checks, and right-to-work confirmation are run by an external SaaS HR platform against specialized tools. The platform exposes this as an HR assistant agent, so rather than reimplement it the supervisor delegates verification to that agent over agent-to-agent, an agent the enterprise consumes but neither hosts nor manages. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Classify the external A2A delegation as southbound egress.
The SaaS HR agent is outside the enterprise boundary, so state explicitly that this delegation uses the southbound gateway contract, including endpoint controls, credential mediation, DLP, redaction, and destination filtering. This should not be left implicit in the generic A2A wording.
As per path instructions, this is concise, high-level safety guidance.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cells-as-the-containment-unit-for-gentic-systems.md` at line 309, Update the
paragraph describing delegation to the external HR assistant agent to explicitly
classify it as southbound egress via the southbound gateway contract. State that
the delegation applies endpoint controls, credential mediation, DLP, redaction,
and destination filtering, while keeping the guidance concise and high-level.
Source: Path instructions
Validate verification results before ATS persistence.
Expanding the flow to employment, education, and right-to-work checks still leaves the downstream wording as direct persistence of returned SaaS results. Require candidate/request binding, provenance, verification status, and validation before results enter the ATS or approval context. This remains the same contract gap noted in the previous review.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cells-as-the-containment-unit-for-gentic-systems.md` at line 309, The
verification flow must validate external HR assistant results before they enter
the ATS or approval context. Update the verification delegation and downstream
persistence described in the pipeline to require candidate/request binding,
trusted provenance, and an explicit successful verification status, rejecting or
quarantining results that fail validation before ATS updates or approval
decisions.
Source: Path instructions
1 participant
Purpose