Bot Access Control · Essential · Critical impact

Agent permission model (agent-permissions.json)

Declares which actions an agent may take, which are refused, and which need a person. It is the difference between a policy and a wish: in the curated corpus we measured, roughly one site in a hundred publishes one.

Essential
Critical impact
Experimental standard

Agent permission model (agent-permissions.json) — Property, Value
Property	Value
Check id	`agent-permissions`
Dimension	Bot Access Control (18%)
Tier	Essential — pool 80 pts
Weight inside tier	3
Impact	Critical
Maturity	Experimental — An early convention that may still change shape.
Conditional	No
Publishing skill	`agent-permissions`
Standards	—

What the scanner requests

/.well-known/agent-permissions.json
/agent-permissions.json

What is measured

The scanner requests /.well-known/agent-permissions.json and falls back to /agent-permissions.json, expecting HTTP 200 with a JSON object that maps named actions to a permission decision. It passes when the document declares a default plus at least one allow action and at least one human-approval action, returns partial when it parses and names actions but has no human-approval rule or is only a flat list of action names, and fails when both paths answer non-200 or return a body that is not JSON.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              DOMAIN="example.com"
for P in /.well-known/agent-permissions.json /agent-permissions.json; do echo "$P -> $(curl -sS -o /dev/null -w '%{http_code} %{content_type} %{redirect_url}' "https://$DOMAIN$P")"; done; curl -sS "https://$DOMAIN/.well-known/agent-permissions.json" | grep -Eo '"(allow|deny|human-approval)"' | sort | uniq -c

The fix

This is the artifact to ship. It is the complete change, not a description of one.

              {
  "version": "1.0",
  "site": "https://example.com",
  "updated": "2026-10-08",
  "default": "deny",
  "actions": {
    "read:public-content": { "permission": "allow" },
    "read:pricing": { "permission": "allow" },
    "train:model": { "permission": "deny" },
    "scrape:bulk": { "permission": "deny" },
    "purchase:create-cart": { "permission": "allow" },
    "purchase:pay": { "permission": "human-approval", "note": "A human confirms payment before capture." },
    "account:change-credentials": { "permission": "deny" }
  },
  "contact": "agents@example.com",
  "policy": "https://example.com/ai-policy"
}

Related checks

Related checks — Check, Tier, Impact, Same skill
Check	Tier	Impact	Same skill
`webbotauth` — Web Bot Auth key directory	Essential	Critical	—
`ai-rules` — Named AI bot rules in robots.txt	Essential	High	—
`ai-policy` — AI usage policy page	Essential	High	—
`bot-page` — Crawler and agent policy page	Recommended	Medium	—
`security-txt` — security.txt (RFC 9116)	Recommended	Low	—
`crawl-delay` — Crawl rate declaration	Emerging	Low	—
`ai-txt` — /ai.txt access declaration	Emerging	Low	—