.well-known/agent-permissions.json

What is agent-permissions.json?

A JSON file at https://yoursite.com/.well-known/agent-permissions.json that acts as a permission manifest for AI agents. Its authors describe it as a robots.txt-style lightweight manifest for the agent era: structured, versioned rules that compliant agents read before acting on your site.

Why AI agents need it

Agents that do things, fill forms, follow flows, gather quotes, need clearer rules than "crawl or don't crawl." The spec defines two layers in one file: deterministic resource rules (which parts of your site agents may access, with rate limits) and natural-language action guidelines that compliant agents evaluate at runtime (for example, "do not submit this form more than once").

The business value for you

Blanket-blocking AI agents is not a strategy; compliance-based coordination is. This file lets compliant agents interact with your site usefully while you keep clear, published boundaries, enabling helpful AI-driven interactions without giving up control. The guidelines in your manifest are always owner-curated: we generate the structure, you own the policy.

How it came to be

Published in August 2025 by the Lightweight Agent Standards Working Group (LAS-WG), researchers from Oxford, Stanford, and Microsoft, as the paper Permission Manifests for Web Agents (Marro et al.), with a formal JSON schema and a reference implementation. It is one of the few files in the agent ecosystem with a peer-visible academic specification behind it.

Source: Marro et al., Permission Manifests for Web Agents (arXiv:2601.02371, August 2025)

Adoption

Earliest-stage of the package: the spec is young and real-world deployment is still concentrated among early movers. That cuts both ways, agents can't rely on finding it yet, and publishing one puts you in the cohort that agent platforms test against. Cloudflare's 2026 agent-readiness analysis found emerging agent-discovery standards on only a handful of sites in its entire dataset, noting "there is lots of opportunity to stand out by being one of the first sites to adopt new standards."

Source: Cloudflare, Introducing the Agent Readiness score (2026)

The technical reality

The file must conform to the LAS-WG schema, metadata, resource_rules, action_guidelines, and api sections, be valid JSON, be served at the exact well-known path, and stay synchronized with what your site actually allows. A syntax error or a rule that contradicts your site's behavior makes agents fail or fall back to guessing. Our generator conforms to the full published schema, validates the output before delivery, and refreshes the manifest under the managed subscription.

What happens if you skip it

Compliant agents have no published rules to follow on your site, so they either guess (and make mistakes on your forms and flows) or decline to act at all. You also lose the clearest published mechanism for saying "here is what I permit" as agent traffic grows.