A machine-readable policy format for AI-agent governance on websites
A2WF pre-Community-Group community review · 2026-05-27
Status: Editor's Draft (v1.1.0-draft.2), not stable, not W3C-endorsed.
The A2WF Community Group is proposed, not yet chartered.
Editor: Wolfgang Wimmer (SSC) ·
Repository: github.com/a2wf/spec ·
Live tools: a2wf.github.io/spec/tools/
From a practitioner's view, not a standards exercise.
That envelope is A2WF. One JSON file per site, at a fixed location, reusing existing standards.
A2WF only works if four pieces move together.
| Pillar | What has to change | Who moves it |
|---|---|---|
| Agent identification | Agent frameworks identify themselves on requests instead of mimicking generic browsers. | OpenAI, Anthropic, Google, browser-automation vendors |
| Policy consumption | Agents fetch and respect siteai.json before acting; oversight levels honoured. | Same vendors, plus open-source agent libraries |
| Site publication | Critical mass of websites publishes siteai.json so agents have something to check. | CMS plugins (WordPress, Shopify), site operators, reseller partners |
| Agent detection | Better mechanisms to detect AI agents that ignore or disguise themselves, so non-compliant traffic can be flagged. | Browser-fingerprinting research, WAF / CDN vendors, security community |
| Regulatory anchor | EU AI Act and Code of Practice in the EU, NIST AI RMF and CAISI in the US, cite machine-readable governance as a recognised signal. | EU Commission, NIST, national DPAs, standards bodies |
None of these is purely the CG's job. Our role is to make all four possible and credible.
Outreach and groundwork before this first community call.
Four open-source tools to make A2WF immediately usable. All MIT, all static, no telemetry.
| Tool | What it does |
|---|---|
| Wizard | Click-through generator: a site operator answers simple questions and gets a valid siteai.json file to download. |
| Validator | Drag-and-drop checker: load any siteai.json and see pass, warn, or fail findings with references to the spec. |
| EU Governance Readiness Checker | Fetches a live site's A2WF policy and maps it to EU AI Act and GDPR anchors. Produces a coverage view, not a compliance certificate. |
| Logger snippets | Server-side code samples (nginx, Apache, Cloudflare, Express, WordPress) that record agent fetches with privacy-preserving defaults. |
Live at a2wf.github.io/spec/tools/. Third parties may wrap them with their own branding, with the disclaimer "not A2WF-endorsed".
Slides: a2wf.github.io/spec/slides/cg-meeting-2026-05-27/ · Markdown source: on repo
Five domains A2WF touches on the agent-web boundary.
| Domain | What A2WF does here | Standards reused |
|---|---|---|
| Governance | Declares which actions are permitted, prohibited, or require human oversight; aligns with EU Code of Practice and AI Act obligations. | Schema.org, ODRL, EU CoP |
| Audit and provenance | Site-side logging contract: what gets recorded, how it is signed, how an auditor can verify declared vs. observed behaviour. | PROV-O, RFC 9421, AIVS (opt-in) |
| Authentication and identity | Expects agents to identify themselves; references identity protocols without redefining them. | DID, VC, AIP (opt-in) |
| Privacy and jurisdiction | Declares personal-data categories, processing purposes, applicable legal regions (GDPR, CCPA, ...). | DPV, ISO-3166 |
| Discovery | Fixed well-known location for the site policy; agents can find it deterministically without crawling. | RFC 8615, RFC 8288 |
Work A2WF touches, complements, or watches - not orchestrated inside our spec, but on the same map.
| Name | Where | Relation to A2WF | Status in v1.1 |
|---|---|---|---|
| AIPREF | IETF WG | Site-side opt-out for AI content use (training, search). Complement: AIPREF covers content use, A2WF covers agent actions. | Watched, not referenced |
| robots.txt + extensions | de-facto / IETF | Crawler access control. A2WF sits on top: once an agent is allowed in, what may it DO? | Watched, not referenced |
| Anthropic ClaudeBot User-Agent convention | Vendor | Voluntary header naming for AI crawlers. Useful identity signal; no standard yet. | Acknowledged, not relied on |
| llms.txt / ai.txt | Community proposals | Markdown summaries for LLM ingestion. Different layer (content-shaping, not governance). | Out of scope |
| NLWeb, MCP, A2A | Industry (Microsoft, Anthropic, Google) | Agent-to-tool and agent-to-agent protocols. Informative context; A2WF stays site-facing. | Informative only |
| W3C AIKR CG (Paola Di Maio) | W3C CG | AI Knowledge Representation, transparency, hybrid symbolic / sub-symbolic AI. Liaison for review of governance vocabulary. | Liaison, review input adopted |
| W3C WebAgents CG (Fabien Gandon) | W3C CG | Agent semantics on the web. Liaison for the agent-side perspective. | Liaison, outreach pending |
| W3C Agent Identity Protocol CG | W3C CG | 50+ members working on agent identity. A2WF's agentIdentification module references their work. | Referenced (opt-in) |
| W3C Semantic Agent Communication CG | W3C CG | Semantic interoperability between agents. Watching for vocabulary alignment. | Watched, not referenced |
| W3C Agentic Arbitration CG | W3C CG | Dispute resolution between agents and sites. Relevant once A2WF gets enforcement signals. | Watched, future fit |
| W3C DPVCG, ODRL CG | W3C CG | Already orchestrated in A2WF (see main glossary). Listed here for completeness. | Normative (when used) |
| WAI-ARIA | W3C WG | Accessibility semantics. Useful precedent for site-side declarations consumed by non-human clients. | Precedent only |
| Acronym | Full name | What it defines |
|---|---|---|
| ODRL | Open Digital Rights Language (W3C Rec) | Machine-readable permissions, prohibitions, and obligations on digital assets. |
| Schema.org | Schema.org Actions vocabulary | Shared vocabulary for actions on the web (BuyAction, ReserveAction, OrderAction). |
| DPV | Data Privacy Vocabulary (W3C DPVCG) | Terms for personal-data categories, processing purposes, legal bases (GDPR-aligned). |
| DID | Decentralized Identifiers (W3C Rec) | Self-sovereign identifiers not tied to a central registry. |
| VC | Verifiable Credentials (W3C Rec) | Cryptographically signed claims an entity can present to prove attributes. |
| PROV-O | Provenance Ontology (W3C Rec) | Who did what, when, with which inputs - audit trail vocabulary. |
| AIP | Agent Identity Protocol (IETF draft) | Header-based identification of AI agents on HTTP requests. |
| AIVS | AI Verifiable Statements (IETF draft) | Agent-side signed log of actions taken, with integrity proofs. |
| EU CoP | EU Code of Practice for general-purpose AI | Voluntary EU Commission code that operationalises AI Act obligations. |
| RFC 8615 | Well-Known URIs (IETF) | Convention for /.well-known/ paths used by our discovery endpoint. |
| RFC 9421 | HTTP Message Signatures (IETF) | Signing HTTP requests and responses for integrity and authenticity. |
| Standard | Used for | Status in A2WF v1.1 |
|---|---|---|
| Schema.org Actions | permissions[].schemaOrgType | Conditional normative |
| W3C DID Core | Agent identity resolution | Conditional normative (agentIdentification) |
| W3C VC Data Model 2.0 | Agent credentials | Conditional normative (agentIdentification) |
| HTTP Message Signatures (RFC 9421) | Request authentication | Conditional normative (agentIdentification, auditTrail) |
| OAuth 2.0 (RFC 6749) | Delegated authorisation | Conditional normative (agentIdentification) |
| W3C ODRL 2.2 | Architectural precedent | Informative; companion profile is a v1.2 candidate |
| W3C DPV 2.x | Data-handling vocabulary | Conditional normative (dataHandling) |
| llmstxt.org | Discovery hint, not replaced | Informative compatibility note |
| AIP (IETF Internet-Draft) | Agent identity protocol | Experimental, optional |
| RFC 8615 (.well-known) / RFC 9309 (robots) | Discovery path | Normative |
A2WF v1.1 is a website declaration envelope. It reuses external vocabularies wherever stable and adds only the minimum new shape it needs.