The A2A controller implements the complete ReferenceGrant consent model: grant check before lookup, a ReferenceGrant watch (target-namespace index) so granting/revoking reconciles immediately, and config withdrawal on revocation. Kuadrant#1139 adds the grant check to MCPServerRegistration but (as of its current revision) has neither the watch nor the withdrawal — meaning a revoked grant changes nothing until an unrelated event, and even then the server keeps serving. Once Kuadrant#1139 merges upstream, the watch + withdrawal should be backported so both registrations enforce consent identically ; the A2A implementation is the reference (grant matcher, index, watch wiring, revocation test). Related: MCPServerRegistration carries a TODO about targetRef mutability that A2A resolved by making the field immutable — same conversation, but a breaking change for an existing CRD...
The A2A controller implements the complete ReferenceGrant consent model: grant check before lookup, a ReferenceGrant watch (target-namespace index) so granting/revoking reconciles immediately, and config withdrawal on revocation. Kuadrant#1139 adds the grant check to MCPServerRegistration but (as of its current revision) has neither the watch nor the withdrawal — meaning a revoked grant changes nothing until an unrelated event, and even then the server keeps serving. Once Kuadrant#1139 merges upstream, the watch + withdrawal should be backported so both registrations enforce consent identically ; the A2A implementation is the reference (grant matcher, index, watch wiring, revocation test). Related: MCPServerRegistration carries a TODO about targetRef mutability that A2A resolved by making the field immutable — same conversation, but a breaking change for an existing CRD...