How to Tell AI Agents What They May Do on Your Site
Published November 7, 2026 · Reviewed November 2026 · By the Ingenious AI team
The short answer
You tell AI agents what they may do by publishing one JSON file, agent-policy.json, at /.well-known/: a default for unnamed agents, per-agent rules for the ones you name, permitted and disallowed actions, and commercial terms — then validate it. AgentGate's free generator writes the file from a short questionnaire. Method per the AGENT-POLICY v0.1 spec and its published samples, November 2026.
What are the five steps?
| Step | Decision | Your options |
|---|---|---|
| 1. Set the default | What may an agent you have never heard of do? | allow · block · conditional (contact you first) |
| 2. Name your agents | Which agents get their own rule? | Identifiers in vendor/agent form, e.g. openai/agent; generic/* catches the rest |
| 3. List the actions | What may each agent do — and not do? | 12 suggested actions, from browse and read to checkout and api-call |
| 4. Set the terms | Free, paid, or talk first? How fast? What data use? | free · paid-tier · contact, plus rate_limit and data_use_terms |
| 5. Publish and validate | Serve it where agents look, and check it conforms | /.well-known/agent-policy.json, no authentication; run the free validator |
What do real decisions look like?
The spec's fictional store, Brightline Goods, is the worked example. Its default is conditional. On top of that sit three rules: openai/agent is allowed on a paid-tier — browse, read, search, shop at up to 60 requests per minute — but may not check out, submit forms, or call APIs, and catalog data may be used for shopping assistance only, never resold or trained on. perplexity/agent is allowed free at 30 requests per minute to browse, read, search, summarize, and quote, with quotes linking back. generic/* — every other agent — is conditional: contact the store first, browse and read only, 10 requests per minute. Three agents, three genuinely different answers, one file.
The other samples mark the ends of the dial: a fictional blog whose default is allow, with a single rule switching one named agent off entirely; and a fictional bank whose default is block with an empty agents list — when the default says everything, rules are optional. Browse all three on the samples page, and if you have not yet seen the format itself, start with what an agent access policy is.
What mistakes invalidate a policy?
Two are mechanical and common. Listing the same action in both permitted_actions and disallowed_actions of one rule is a contradiction — the document is invalid, because an agent reading it cannot know which list wins. Repeating an identifier in two rules is also an error: the spec defines no first-match-wins. Beyond those, keep last_updated honest — it is the date you last reviewed the policy, and agents weighing your terms will read it that way. Run the free validator before you publish; it checks the required fields, the value domains, and both contradiction rules. One honest limit, stated on every AgentGate page: the file declares your terms, it cannot force an agent to obey them. How that differs from robots.txt is covered in agent policy vs robots.txt. The rest of the fleet lives at getingeniousai.com.
Frequently asked questions
How do I tell AI agents what they may do on my site?
Publish an agent-policy.json file at /.well-known/agent-policy.json. Set a default_policy (allow, block, or conditional), add per-agent rules for the agents you care about, list each agent's permitted and disallowed actions, state commercial terms, then validate the file. AgentGate's free generator writes the file from a short questionnaire.
What is the difference between allow, block, and conditional defaults?
The default covers every agent you do not name. Allow lets unnamed agents operate, block refuses them, and conditional means 'contact the owner first'. AgentGate's own published policy uses conditional as its default, with a generic/* rule permitting browse, read, search, and summarize while disallowing checkout, submit-form, and api-call.
Which actions can I permit or disallow?
The v0.1 suggested vocabulary has 12 actions: browse, read, search, summarize, quote, shop, checkout, book, submit-form, download, api-call, and crawl-full-site. The vocabulary is non-exhaustive — owners may use other action names, and validators warn rather than fail on unknown actions so the list can grow.
Can I treat different agents differently?
Yes — that is the point of per-agent rules. The fictional store sample in the spec lets openai/agent browse and shop on a paid tier at 60 requests per minute, lets perplexity/agent read and quote free at 30 per minute, and holds generic/* to conditional at 10 per minute, with checkout disallowed for all three.
What happens if I list the same action as permitted and disallowed?
The document is invalid. v0.1 conformance rule 3 states that an action appearing in both lists of the same rule is a contradiction. Duplicate agent identifiers are also an error — first-match-wins is not defined. The free validator checks both before you publish.