Visibility & Helix

Every agent has an a2aVisibility property that controls whether it appears in fleet cards and can be invoked via A2A.

Visibility levels

Level	Fleet card	Who can invoke	Use case
`internal`	Never served	Only the platform itself (direct orchestration)	Default for most agents. Internal helpers, analyzers, planners.
`tenant`	Same-tenant fleet card	Any agent in the same workspace with a valid scoped token	Agents you want other agents in your workspace to delegate to.
`external`	Public fleet card	Any valid scoped token (cross-tenant)	Agents published to the A2A Marketplace for cross-org use.

Default is internal. When a2aVisibility is omitted or set to internal, the agent is invisible to A2A discovery. Opt in to discoverability when you are ready.

Configuring visibility in Helix

When creating agents through the Helix workflow editor, you can configure A2A visibility directly in the agent spec form:

Navigate to Automate → Helixes in the app
Create or edit a Helix workflow
Select a step and expand the Agent Spec section
Set the A2A Visibility dropdown to your desired level:
- Internal — not discoverable (default)
- Tenant — discoverable to same-workspace agents
- External — discoverable cross-tenant (for marketplace publishing)

The visibility setting is part of the InlineAgentSpec type:


interface InlineAgentSpec {
  name: string;
  model: string;
  systemPrompt: string;
  capabilities: string[];
  tools?: string[];
  connectorIds?: string[];
  delegatesTo?: string[];
  knowledgeBaseIds?: string[];
  a2aVisibility?: 'internal' | 'tenant' | 'external';
}

Core discoverable agents

The following built-in agents are pre-configured with tenant visibility:

Agent	Role	Capabilities
Cendriix Coder	Full-stack implementation	`code_generation`
Cendriix Reviewer	Code review and security audit	`code_review`, `security_review`
Cendriix Orchestrator	Multi-agent coordinator	`planning`, `analysis`

All other core agents (Analyst, Planner, Tester, Deployer, Research, etc.) remain internal and are only accessible through direct platform orchestration.

Security considerations

Tenant-scoped tokens can only invoke agents within the same workspace. A token minted by tenant A cannot invoke a tenant-visible agent owned by tenant B.
Cross-tenant invocation (for external agents) goes through an additional consent check and requires the target tenant to have explicitly published the agent to the marketplace.
Per-run policy caps still apply to all A2A invocations — token budget, iteration limits, and guardrails are enforced regardless of the invocation path.
Fleet cards are HMAC-signed to prevent tampering. Clients should verify the signature before trusting card contents.