Enum InboundTracePolicy 

#[non_exhaustive]
pub enum InboundTracePolicy {
    Continue,
    Restart,
    Drop,
}

What this deployment does with a traceparent an unauthenticated peer sent it.

The threat this exists for

The inbound trace is joined while the request’s CallContext is built, which runs before the interceptor chain — and the interceptor chain is where authentication happens. So on a public endpoint the peer choosing the trace-id and the sampling bit is, at that moment, anonymous.

W3C Trace Context §7.2 “Denial of Service” names exactly this: “When distributed tracing is enabled on a service with a public API and naively continues any trace with the sampled flag set, a malicious attacker could overwhelm an application with tracing overhead, forge trace-id collisions that make monitoring data unusable, or run up your tracing bill with your SaaS tracing vendor.” Its own suggested remedy is “different tracing behavior for authenticated and unauthenticated requests”.

§3.4 names the mutation that implements it: “Restart trace: All properties (trace-id, parent-id, trace-flags) are regenerated. This mutation is used in services that are defined as a front gate into secure networks and eliminates a potential denial-of-service attack surface. Vendors SHOULD clean up tracestate collection on traceparent restart.”

Set per handler with RequestHandlerBuilder::with_inbound_trace_policy, so a process serving both a public front gate and an internal endpoint can hold a different policy on each.

Why Continue is still the default

A2A’s premise is a mesh of agents delegating to one another, and one trace id surviving every hop is the only thing that makes such a chain readable. Restarting by default would sever every chain to protect the deployments that are front gates, which are the minority. A front gate opts in.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Continue

Join the peer’s trace: same trace-id, a fresh span. The right answer inside a trusted mesh, and the historical behaviour.

Restart

Restart the trace, per §3.4: mint a new trace-id and parent-id, reset trace-flags, and drop tracestate — the peer controls none of it. The request still carries a trace, so this hop and everything below it remain correlated; what is severed is the attacker’s ability to choose the identifier or the sampling decision.

Drop

Refuse to trace an untrusted request at all. Cheaper than Restart — nothing is minted and nothing is recorded — and appropriate where the tracing bill, not the trace tree, is the thing being protected.

Trait Implementations

impl Clone for InboundTracePolicy

fn clone(&self) -> InboundTracePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for InboundTracePolicy

impl Debug for InboundTracePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for InboundTracePolicy

fn default() -> InboundTracePolicy

Returns the “default value” for a type.

impl Eq for InboundTracePolicy

impl PartialEq for InboundTracePolicy

fn eq(&self, other: &InboundTracePolicy) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for InboundTracePolicy