A2A authentication

discover_market is public. Every other skill requires Authorization: Bearer with a BreezeWish credential. Scopes and autonomy are enforced when the underlying REST or MCP operation runs.

The Agent Card's security scheme is HTTP bearer. Do not embed a token in the card.