A reference implementation in 2000 lines of Python. Parameter binding closes the drift attack; consent atomicity, independent consent surface, and destination gating make four necessary and sufficient constraints for agent delegation.
The single-use property has two layers. Almost every published design enforces the wrong one. About thirty lines closes the gap.
A code-anchored walkthrough of how a2a-mcp-bridge-reference realises the security core (Vault delegation) and the two carriers that move a signed approval to the human and back: single-domain MCP elicitation emission, now implemented, and multi-domain A2A across agents.