Limitations and Troubleshooting

Agentic Orchestrator only

Native A2A support, where Moveworks calls a remote agent through its Agent Card, is available only on the Agentic Orchestrator. The Agentic Orchestrator is in Controlled Availability and comes to your Enterprise Assistant as an upgrade in Q1 2027. Capabilities, limits, and interface labels described here may change before general availability. To request access, contact your Moveworks account team.

Limitations

Standard token requests only. Authentication comes from the agent’s HTTP connector. Custom grant types, additional token-request headers or body fields, and custom per-user headers are not supported.
Transport. The agent’s card must advertise a JSON-RPC or HTTP+JSON interface. gRPC-only agents are not supported.
Text and structured data. The assistant receives the remote agent’s text and structured data parts. Intermediate progress updates while the agent is working are not shown; the assistant hears back when the turn completes, fails, or needs input.
One message at a time. A conversation accepts one in-progress message. A second send while the agent is still working is rejected, not queued.
No cancellation. The assistant cannot cancel a task the remote agent is working on. A turn that times out is abandoned on the Moveworks side, but the remote agent may still complete it.
Not a plan step. A2A tools run directly in the reasoning loop. They cannot be scheduled as a step in a plan.
Assistants on the Agentic Orchestrator. A2A agents are offered only to assistants that list them, which today means Productivity Assistants. The Enterprise Assistant has no A2A agent selection and does not call A2A agents.
Per-session continuity. An A2A conversation belongs to the user’s session with the assistant. A new session starts a new conversation with the remote agent.
Up to 50 agents per assistant.

View A2A Logs

Every A2A turn creates log entries in the Logs app: one when the assistant sends a message and one when a result is delivered. Use them to confirm which agent was called, inspect what was sent, review what came back, and diagnose failures.

Elevated permission required

A2A log entries require the elevated Logs permission, regardless of who triggered them. Users with the basic Logs Viewer permission do not see them.

Find an A2A turn

Open the Logs app, then use the most specific filter you have:

Enter the conversation’s Root UUID to see A2A turns from that conversation.
Select the A2A agent from the Plugin filter to see every turn with that agent.
Select a2a.turn.dispatch or a2a.turn.result from the Log Type filter to see all A2A sends or all A2A results.

Read the entries

Entry	What it records
`a2a.turn.dispatch`	One per message the assistant sent, after the agent was resolved: the agent, the execution ID, the message text, and whether the send was accepted, resolved inline, or failed before reaching the agent.
`a2a.turn.result`	One per result delivered to the assistant: completed, needs input, or failed, with the returned text and data parts. A result the Moveworks gateway produced itself, such as a timeout or a configuration error, is recorded with that source.

The two entries for one turn share a registration ID. A send that was rejected before it reached the agent produces a dispatch entry only. Payload fields are capped at 32 KiB each; when a field was cut, the entry names it in truncated_fields. Redaction follows the agent’s launch configuration, as for plugins; see Log Redaction.

Troubleshooting

Fetching the agent card fails

What you see	Likely cause	Fix
Fetch Agent Card is disabled	No connector selected	Select a connector first.
The base URL must use HTTPS	The connector’s base URL starts with `http://`	Change the connector to HTTPS. HTTP is accepted only for connectors routed through the Moveworks Agent.
Failed with a redirect	The agent redirects the card request	Point the connector base URL or the agent card path at the final location. Redirects are not followed.
Failed with an authentication or token error	The connector’s credentials were rejected, its token endpoint is unreachable, or a per-user connector has not been authorized by the administrator	Check the connector’s credentials, scopes, and token URL. For a per-user connector, authenticate it in Tool Studio before fetching the card.
Timed out	The agent did not answer within 10 seconds	Confirm the agent is reachable from Moveworks; see Network Allowlisting.
The remote agent returned an empty agent card, or a schema error naming a field	The path returned something other than a valid Agent Card	Check the agent card path. Leave it empty for the protocol default or enter `/` if the base URL itself serves the card.

Saving the agent fails

What you see	Fix
The connector’s authentication type is not supported	Use an HTTP connector with OAuth 2.0 Authorization Code, OAuth 2.0 Client Credentials, a bearer token, an API key, or basic authentication.
The selected connector was not found, or has no configuration	Select a connector that exists and is fully configured.
Path must start with / and contain no query string	Correct the agent card path.
The schema must be a JSON object with `"type": "object"`, or must be self-contained	Fix the metadata schema as described in Outbound Metadata.

The assistant never calls the agent

The agent is not on the assistant. In Assistant Builder, confirm the agent is selected. Only published agents appear in the picker.
The agent is disabled. Open the agent in Tool Studio and set it to Enabled.
The user is outside the launch audience. Check the agent’s Launch Configuration tab. The audience is enforced on every send.
The description does not match the request. The model selects the agent by its description alone. Rewrite it to name the tasks the agent handles and the phrases users use.

The agent works for some users but not others

They have not signed in. With a per-user connector, each employee must complete the in-chat sign-in prompt the first time a request needs the agent. Ask them to repeat the request and complete the prompt.
Their token expired or was revoked. Moveworks refreshes tokens when the provider allows it. If refresh fails, the user disconnects the integration on their Connections page and authorizes it again.
Their upstream permissions differ. With per-user authorization, the remote agent enforces each employee’s own permissions. Check the user’s access in the system behind the agent.

The assistant says the agent cannot be used

“This A2A agent is not enabled for this assistant.” The agent is not in the assistant’s selection. Add it in Assistant Builder, or use an assistant that lists it.
A message about an unusable metadata schema. The schema cannot be presented to the model, usually because it is too large once merged with the tool’s inputs. Simplify the schema; see Outbound Metadata.
A configuration error on a send. The outbound metadata expression failed or returned a non-object, or the stored card no longer describes a reachable interface. Fix the expression, or fetch the card again and save.

A send is rejected because a message is still in progress

The remote agent is still working on the previous message. Wait for that turn to finish. The assistant is told the message was not sent or queued, so it can retry after the result arrives.

A turn times out or never returns

A missing result does not prove the remote agent did nothing. If the message asked the agent to perform an action such as a booking or a ticket update, check the agent’s own records before repeating the request. The next message to the same agent continues the same conversation context. When escalating, include the execution ID from the a2a.turn.dispatch log entry.