Auditing Agent Handoffs Without Centralizing Raw Messages: Evidence Boundaries and Release Tradeoffs

Agent delegation can disclose sensitive information across organizational boundaries, while centralized logging can create a second repository of sensitive content. We study the separation between metadata-based auditing and local release enforcement. An experimental A2A metadata interface exposes labels, identities and hashes rather than raw messages; a separate structured gate checks authorization, case relevance and exact source support. These are scoped checks, not guarantees of semantic confidentiality. On 20 authored tasks with shared frozen model proposals, the full gate preserves eight benign completions, removes two forbidden-marker and four unsupported-value releases, and returns unknown on nine tasks. In action-prefix replay of 1,132 archived AgentDojo trajectories, destination binding reduces native attack success from 165/808 to 0/808 while clean completion falls from 198/324 to 179/324. A separate frozen live study compares eight methods on 32 development-disjoint tasks using one 14B model and one seed. Ungated execution completes 10/32 tasks with one attack success in 16 attacked tasks; defended variants complete 0–12 tasks with zero observed attacks. Sparse attacks and wide paired intervals preclude a defense ranking. We expose the observation boundaries, failure cases and cost accounting needed to interpret these results without conflating non-disclosure, task failure and privacy.