Preferred method: root URL

A publishing site MUST serve siteai.json from the well-known location at the root of its origin:

https://example.com/siteai.json

The file MUST be served with HTTP status 200 OK and Content-Type: application/json.

Alternative: robots.txt directive

A publishing site MAY also declare the location of its siteai.json in robots.txt using the non-standard but conventional directive:

SiteAI: https://example.com/siteai.json

Alternative: HTML <link> tag

A publishing site MAY include a <link> element in the document head:

<link rel="siteai" href="https://example.com/siteai.json">

Alternative: well-known URI

A publishing site MAY also serve the file at /.well-known/siteai.json for compatibility with well-known URI conventions [[RFC8615]]. When both a root and well-known location are present, they MUST point to the same content.

Priority and retrieval

Consuming agents SHOULD retrieve siteai.json in the following order, stopping at the first successful retrieval:

1. Root URL (/siteai.json)
2. Well-known URI (/.well-known/siteai.json)
3. HTML <link rel="siteai"> in the home page
4. SiteAI: directive in robots.txt

File serving requirements

• The file MUST be served over HTTPS.
• The file SHOULD be cacheable with reasonable Cache-Control headers (e.g. max-age=3600).
• The file SHOULD be at most a few hundred kilobytes; consuming agents MAY truncate or reject responses larger than 1 MiB.

Top-level structure

A siteai.json document MUST consist of a single JSON object [[RFC8259]]. The root object MUST contain:

• specVersion (String): REQUIRED. Must be "1.0".
• identity (Object): REQUIRED. Core website identification.
• permissions (Object): REQUIRED. Agent access policies.

The root object SHOULD contain:

• @context (String): RECOMMENDED. "https://schema.org".
• agentIdentification (Object): RECOMMENDED.
• scraping (Object): RECOMMENDED.

The root object MAY contain additional members defined in Optional governance extensions. Consuming agents MUST ignore any unrecognised members.

The identity object (REQUIRED)

Provides core identifying and contextual information about the publishing site. Where applicable, fields use Schema.org WebSite vocabulary.

The permissions object (REQUIRED)

The core governance layer. Contains three sub-objects that control different aspects of AI agent interaction: read, action, and data.

The agentIdentification object (RECOMMENDED)

Defines requirements for AI agent self-identification.

• requireUserAgent (Boolean) — agent MUST include an identifying User-Agent header.
• requiredFields (Array<String>) — fields the agent must provide; valid values include "agentName", "agentOperator", "agentPurpose".
• allowAnonymousAgents (Boolean) — default true. If false, unidentified agents MUST be denied.
• trustedAgents (Array<Object>) — whitelist; each entry has { name, operator, permissions }.
• blockedAgents (Array<Object>) — blacklist; each entry has { pattern, reason }.

The scraping object (RECOMMENDED)

Declares policies on automated data extraction.

• bulkDataExtraction (Boolean) — default false. Systematic large-scale extraction.
• priceMonitoring (Boolean) — default false. Automated price-change tracking.
• contentReproduction (Boolean) — default false. Reproducing or republishing content.
• competitiveAnalysis (Boolean) — default false. Data collection for competitive intelligence.
• trainingDataUsage (Boolean) — default false. Using site content as training data.
• note (String) — OPTIONAL. Additional context or licensing information.

The defaults object

Global default settings that apply unless overridden by individual permissions.

• agentAccess (String) — "open" (permissive), "restricted" (deny by default), or "minimal" (deny everything except explicit allows).
• requireIdentification (Boolean) — default false.
• humanVerificationRequired (Boolean) — default false. If true, all actions require human verification.
• maxRequestsPerMinute (Integer) — global per-minute rate limit.
• maxRequestsPerHour (Integer) — global per-hour rate limit.
• respectRobotsTxt (Boolean) — default true.

The humanVerification object

Defines human-in-the-loop requirements for sensitive actions.

• methods (Array<String>) — accepted methods: "redirect-to-browser", "email-confirmation", "sms-otp".
• requiredFor (Array<String>) — names of actions that require human verification.
• note (String) — additional human-readable instructions.

The legal object

References Terms of Service and regulatory frameworks.

• termsUrl (String) — RECOMMENDED. URL to AI-specific Terms of Service.
• complianceNote (String) — OPTIONAL human-readable compliance statement.
• dataRetention (String) — OPTIONAL rules for agent data retention.
• euAiActCompliance (Object) — OPTIONAL. EU AI Act-specific metadata supporting Regulation (EU) 2024/1689 [[EU-AI-ACT]]:
  • transparencyRequired (Boolean) — agents must identify as AI.
  • riskClassification (String) — "minimal", "limited", "high", or "unacceptable".
  • humanOversightMandatory (Boolean).

The discovery object

Links to complementary web resources.

• mcpEndpoint (String) — URL to an MCP server card.
• a2aAgentCard (String) — URL to an A2A agent card.
• robotsTxt (String) — URL to robots.txt.
• llmsTxt (String) — URL to an llms.txt file.
• schemaOrg (Boolean) — whether Schema.org markup is present on the site.
• openApi (String) — URL to an OpenAPI specification.

The metadata object

• $schema (String) — URL of the JSON Schema for validation.
• schemaVersion (String) — specification version, e.g. "1.0".
• generatedAt (String) — RFC 3339 timestamp of generation.
• author (String) — policy creator.
• lastUpdated (String, ISO date) — last modification date.
• expiresAt (String, ISO date) — policy expiration date.
• changelogUrl (String) — URL to policy change history.

Technical enforcement

Publishing sites MAY enforce policies through:

• HTTP 403 responses to non-compliant agents.
• Rate limiting based on declared limits.
• Web Application Firewalls with agent-aware rules.
• User-Agent-based blocking for agents that violate declared policies.

Audit and logging

Publishing sites SHOULD log agent access patterns and compare them against declared policies. The agentIdentification section enables meaningful audit trails by requiring agent self-identification.

Policy integrity

The siteai.json file MUST be served over HTTPS to prevent tampering. Publishing sites SHOULD implement integrity checks and monitor for unauthorised modifications.

Prompt injection

The siteai.json file contains structured data, not executable content. Consuming agents MUST treat all fields as data, not instructions. String fields (especially note) MUST NOT be interpreted as agent commands.

Policy spoofing

Consuming agents MUST only trust siteai.json files served from the domain they describe. Cross-domain policy declarations MUST be rejected unless explicitly referenced via the discovery mechanism.

Denial of service

Rate limits declared in siteai.json are requests from the publishing site, not guarantees. Consuming agents SHOULD respect declared limits. Publishing sites SHOULD implement server-side rate limiting independently of declared policies.

Version strategy

The specVersion field identifies the specification version. Major versions (2.0, 3.0) MAY introduce breaking changes. Minor updates within v1.x MUST remain backward-compatible.

Forward compatibility

Consuming agents MUST ignore any unrecognised members. This ensures that files created with future extensions remain readable by v1.0 consumers.