---
type: Agentic Web Standard
title: "agent-permissions.json"
description: "Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?"
resource: "https://github.com/las-wg/agent-permissions.json"
tags: ["permit", "well-known-file", "community", "let-agents-act-on-my-site", "control-ai-crawling"]
status: draft
generated: { by: agenticweb-builder/1.0, at: 2026-10-30T00:00:00Z }
verified: { by: process:agenticweb-engine, at: 2026-10-29T00:00:00Z }
stale_after: 2026-11-28T00:00:00Z
sources:
  - id: ref-1
    resource: "https://github.com/las-wg/agent-permissions.json"
    title: "Lightweight Agent Standards Working Group (LAS-WG), GitHub - las-wg/agent-permissions.json: robots.txt-style permission manifest for web agents (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): \"robots.txt-style permission manifest for web agents\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-2
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/README.md"
    title: "Lightweight Agent Standards Working Group (LAS-WG), README.md — agent-permissions.json specification in las-wg/agent-permissions.json (commit 44ce979a, 10 December 2025; checked 29 October 2026): \"A robots.txt-inspired standard for how agents may interact with webpages.\" \"Note: This standard is still WIP!\" \"Websites need a machine-readable, non-binding way to declare how automated agents (bots, crawlers, assistants) may interact with them. This JSON-only Agent Permissions File lets sites express fine-grained resource-level rules and higher-level action guidelines in a single, versioned document.\" \"This document does not cover agent-to-agent interactions or content usage policies (see IETF AIPref instead).\" \"This file is advisory and non-binding: agents MAY choose stricter behaviors than those granted here, but MUST NOT exceed the permissions granted if they claim to honor this format.\" \"Consumers MAY locate and fetch the JSON policy via a link tag, e.g.:\" \"In case of no <link> tag, the default path is /.well-known/agent-permissions.json. Servers SHOULD serve this file with Content-Type: application/json.\" \"There are two forms of permissions: Resource permissions: how you can interact with HTML elements (clicking, following links, filling forms, controlling media, uploading files…). Action permissions: what you can do on the web page (sending DMs, booking a flight, posting content…).\" \"The top-level field strict prescribes the default behavior for an action that is not explicitly allowed or forbidden (true: defaults to forbidden, false: defaults to allowed).\" \"Implementation-wise, agents can follow resource_rules at the interface level (e.g. if the agent is using a headless browser to perform an action, the code connecting the agent to the browser can act as an enforcement layer), while action_guidelines are provided as prompt or configuration to the agent.\" \"Some higher-level behaviors (for example, \"fill this form\") are expected to be composite operations built from primitive verbs (e.g. multiple set_input_value calls followed by submit_form).\" \"Finally, the field api provides information on what actions can be performed by calling HTTP APIs (e.g. REST) instead of interacting with the website, as the former is often more efficient and reliable than the latter.\" \"The verb in each resource_rules entry MUST be one of the following values. Future versions MAY extend this list; unknown verbs MUST be treated as disallowed.\" \"\"$schema\": \"http://json-schema.org/draft-07/schema#\", \"title\": \"Agent Permissions File\", \"type\": \"object\", \"required\": [\"metadata\", \"strict\"]\" \"Parse according to the schema; on validation failure, consumers SHOULD treat the file as absent and MUST NOT grant additional permissions based on it (i.e., disallow all interactions beyond their default safety policies).\" \"Apply resource_rules following priority rules: 1. Specific verbs have higher priority over all 2. For the same verb, follow CSS priority rules\" \"We expect the implementation of resource_rules to happen at the browser interface level (e.g. the agent is blocked from performing unintended interactions) and the implementation of action_guidelines to happen at the agent level (e.g. by feeding these rules to the LLM or equivalent decision component).\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-3
    resource: "https://api.github.com/repos/las-wg/agent-permissions.json"
    title: "GitHub REST API, las-wg/agent-permissions.json repository metadata (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): \"\"created_at\": \"2025-08-05T23:47:17Z\", \"updated_at\": \"2026-06-22T15:31:01Z\", \"pushed_at\": \"2025-12-10T22:53:58Z\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-4
    resource: "https://api.github.com/repos/las-wg/agent-permissions.json/commits?per_page=100"
    title: "GitHub REST API, las-wg/agent-permissions.json commit history (5 August 2025 – 10 December 2025; checked 29 October 2026): \"\"date\": \"2025-12-10T22:53:58Z\" }, \"message\": \"Add 'strict' field to agent permissions schema\" \"Added a 'strict' field to define default action behavior.\"\" \"\"date\": \"2025-12-04T01:18:49Z\" }, \"message\": \"Dropped XPath support.\"\" \"\"date\": \"2025-11-27T23:04:01Z\" }, \"message\": \"Update to v0.3 draft.\"\" \"\"date\": \"2025-08-05T23:47:17Z\" }, \"message\": \"Initial commit\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-5
    resource: "https://api.github.com/repos/las-wg/agent-permissions.json/contributors"
    title: "GitHub REST API, samuelemarro contributor statistics on las-wg/agent-permissions.json (checked 29 October 2026): \"\"login\": \"samuelemarro\", \"id\": 13946873, \"node_id\": \"MDQ6VXNlcjEzOTQ2ODcz\", \"avatar_url\": \"https://avatars.githubusercontent.com/u/13946873?v=4\", \"gravatar_id\": \"\", \"url\": \"https://api.github.com/users/samuelemarro\", \"html_url\": \"https://github.com/samuelemarro\", \"followers_url\": \"https://api.github.com/users/samuelemarro/followers\", \"following_url\": \"https://api.github.com/users/samuelemarro/following{/other_user}\", \"gists_url\": \"https://api.github.com/users/samuelemarro/gists{/gist_id}\", \"starred_url\": \"https://api.github.com/users/samuelemarro/starred{/owner}{/repo}\", \"subscriptions_url\": \"https://api.github.com/users/samuelemarro/subscriptions\", \"organizations_url\": \"https://api.github.com/users/samuelemarro/orgs\", \"repos_url\": \"https://api.github.com/users/samuelemarro/repos\", \"events_url\": \"https://api.github.com/users/samuelemarro/events{/privacy}\", \"received_events_url\": \"https://api.github.com/users/samuelemarro/received_events\", \"type\": \"User\", \"user_view_type\": \"public\", \"site_admin\": false, \"contributions\": 9\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-6
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/LICENSE"
    title: "Lightweight Agent Standards Working Group (LAS-WG), LICENSE (MIT License) in las-wg/agent-permissions.json (6 August 2025; checked 29 October 2026): \"MIT License Copyright (c) 2025 Lightweight Agent Standard Working Group (LAS-WG)\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-7
    resource: "https://arxiv.org/abs/2601.02371"
    title: "Samuele Marro et al. (Lightweight Agent Standards Working Group), [2601.02371] Permission Manifests for Web Agents, arXiv abstract and submission history (v1 submitted 7 December 2025; v2 revised 12 January 2026; checked 29 October 2026): \"[v1] Sun, 7 Dec 2025 17:45:01 UTC (207 KB) [v2] Mon, 12 Jan 2026 23:23:48 UTC (208 KB)\" \"Subjects: Computers and Society (cs.CY); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA); Networking and Internet Architecture (cs.NI)\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-8
    resource: "https://arxiv.org/html/2601.02371v2"
    title: "Samuele Marro, Alan Chan, Xinxing Ren, Lewis Hammond, Jesse Wright, Gurjyot Wanga, Tiziano Piccardi, Nuno Campos, Tobin South, Jialin Yu, Sunando Sengupta, Eric Sommerlade, Alex Pentland, Philip Torr, and Jiaxin Pei (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, arXiv:2601.02371v2 HTML edition (12 January 2026; manuscript dated August 2025; checked 29 October 2026): \"arXiv:2601.02371v2 [cs.CY] 12 Jan 2026 Permission Manifests for Web Agents Lightweight Agent Standards Working Group (LAS-WG)\" \"Tobin South Jialin Yu Sunando Sengupta Eric Sommerlade Alex Pentland Philip Torr Jiaxin Pei Affiliation: Stanford University Microsoft UT Austin August 2025\" \"We introduce agent-permissions.json, a robots.txt -style lightweight manifest where websites specify allowed interactions, complemented by API references where available.\" \"llms.txt helps agents read a site efficiently, but not interact with it responsibly.\" \"We therefore treat AIPref and TDMRep as an adjacent layer in a broader stack: content-use signals govern what models may do with data, while our permission manifest governs how agents may behave on pages.\" \"Compared to Pay per Crawl, agent-permissions.json addresses a different problem: specifying permissible interactions rather than monetizing access.\" \"agent-permissions.json provides native support for advertising MCP and A2A endpoints alongside OpenAPI specifications (see Section 3.5).\" \"The file contains four top-level fields: • metadata (mandatory): basic information including schema version, last update timestamp, and document author; • resource_rules (mandatory): rules governing how agents may interact with HTML elements (Section 3.3).\" \"A core design principle of the manifest is that automated interactions operate along two complementary dimensions: interactions with specific resources and general actions (South et al., 2025).\" \"The manifest therefore treats APIs as the \"happy path\" but not the sole path. Agents are encouraged to use APIs when possible, but may fall back to DOM-level interactions when necessary.\" \"In other words, the question for the enforcement system shifts from \"is the agent operating with a malicious intent?\" to \"is the agent following the rules in agent-permissions.json?\"\" \"Since action guidelines are expressed in natural language, a malicious or adversarial site could attempt to use them as a channel for prompt injection or manipulation of agent behavior. Frameworks should therefore treat manifest content as untrusted input\" \"Since most agents rely on headless browser automation (e.g., Selenium, Playwright, and Puppeteer) to interact with websites, we can apply resource rules at the browser interface layer. The mechanism is simple: when the agent attempts an interaction, the driver checks the manifest before issuing the corresponding DOM command. If the action is disallowed, the attempt is blocked.\" \"Samuele Marro is supported by the EPSRC Centre for Doctoral Training in Autonomous Intelligent Machines and Systems n. EP/Y035070/1, in addition to Microsoft Ltd.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-9
    resource: "https://arxiv.org/html/2601.02371v1"
    title: "Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, arXiv:2601.02371v1 HTML edition (7 December 2025; checked 29 October 2026): \"Tobin South Jialin Yu Alex Pentland Philip Torr Jiaxin Pei Affiliation: Anthropic Stanford University UT Austin August 2025\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-10
    resource: "https://arxiv.org/pdf/2601.02371v2"
    title: "Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents (arXiv:2601.02371v2 PDF edition — author list and typeset superscripts Samuele Marro1,2∗, Alan Chan3, Xinxing Ren4, Lewis Hammond1,5, Jesse Wright1,2, Gurjyot Wanga6, Tiziano Piccardi7, Nuno Campos8, Tobin South9,2, Jialin Yu1,2, Sunando Sengupta10, Eric Sommerlade10, Alex Pentland9, Philip Torr1,2, Jiaxin Pei11,9,2, 12 January 2026; checked 29 October 2026): \"Samuele Marro; Alan Chan; Xinxing Ren; Lewis Hammond; Jesse Wright; Gurjyot Wanga; Tiziano Piccardi; Nuno Campos; Tobin South; Jialin Yu; Sunando Sengupta; Eric Sommerlade; Alex Pentland; Philip Torr; Jiaxin Pei\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-11
    resource: "https://las-wg.org/"
    title: "Lightweight Agent Standards Working Group, LAS-WG | Lightweight Agent Standard Working Group official website (checked 29 October 2026): \"LAS-WG develops interoperable standards for agent communication avoiding bloated protocols in favor of quick, iterative testing.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-12
    resource: "https://api.github.com/orgs/las-wg/repos"
    title: "GitHub REST API, las-wg/agent-permissions.json in orgs/las-wg/repos organization repository inventory (5 March 2025 – 15 January 2026; checked 29 October 2026): \"\"full_name\": \"las-wg/agent-permissions.json\", \"private\": false, \"owner\": { \"login\": \"las-wg\", \"id\": 202027760, \"node_id\": \"O_kgDODAqy8A\", \"avatar_url\": \"https://avatars.githubusercontent.com/u/202027760?v=4\", \"gravatar_id\": \"\", \"url\": \"https://api.github.com/users/las-wg\", \"html_url\": \"https://github.com/las-wg\", \"followers_url\": \"https://api.github.com/users/las-wg/followers\", \"following_url\": \"https://api.github.com/users/las-wg/following{/other_user}\", \"gists_url\": \"https://api.github.com/users/las-wg/gists{/gist_id}\", \"starred_url\": \"https://api.github.com/users/las-wg/starred{/owner}{/repo}\", \"subscriptions_url\": \"https://api.github.com/users/las-wg/subscriptions\", \"organizations_url\": \"https://api.github.com/users/las-wg/orgs\", \"repos_url\": \"https://api.github.com/users/las-wg/repos\", \"events_url\": \"https://api.github.com/users/las-wg/events{/privacy}\", \"received_events_url\": \"https://api.github.com/users/las-wg/received_events\", \"type\": \"Organization\", \"user_view_type\": \"public\", \"site_admin\": false }, \"html_url\": \"https://github.com/las-wg/agent-permissions.json\", \"description\": \"robots.txt-style permission manifest for web agents\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-13
    resource: "https://raw.githubusercontent.com/las-wg/info/master/README.md"
    title: "Lightweight Agent Standards Working Group, README.md in las-wg/info (checked 29 October 2026): \"LAS-WG develops interoperable standards for agent communication. We address concrete, immediate challenges by defining clear, focused guidelines that enhance consistency across the industry.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-14
    resource: "https://raw.githubusercontent.com/las-wg/info/master/charter.md"
    title: "Lightweight Agent Standards Working Group, charter.md — Lightweight Agent Standard Working Group (LAS-WG) Charter in las-wg/info (checked 29 October 2026): \"The LAS-WG focuses exclusively on the standardization of specific, clearly defined problems within agent-to-agent communication, agent operation, and agent-to-world communication.\" \"Votes are decided by simple relative majority, typically lasting one week unless a longer period is specified by the Chair. All voting processes are public, with each member organization holding exactly one vote cast by their designated representative.\" \"All LAS-WG outputs and standards shall be licensed under Creative Commons BY 4.0 or an equivalently permissive license.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-15
    resource: "https://raw.githubusercontent.com/las-wg/info/master/voting-members.md"
    title: "Lightweight Agent Standards Working Group, voting-members.md in las-wg/info (checked 29 October 2026): \"The following organizations have voting rights: - AgentOps - Agora Protocol - Agent Network Protocol - Camel AI - Centre for the Governance of AI - Cosmos Institute - LangChain - Massachusetts Institute of Technology - Stanford University - University of Oxford - Wildcard\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-16
    resource: "https://samuelemarro.it/cv/"
    title: "Samuele Marro, cv | Samuele Marro — academic curriculum vitae (March 2025 – present; checked 29 October 2026): \"Mar 2025 - Present Chair Lightweight Agent Standards Working Group Industry-academia joint working group, focused on designing and iterating quickly on standards for agent interactions. Notable organizations: Oxford University, Stanford University, MIT, Firecrawl.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-17
    resource: "https://github.com/las-wg/agent-permissions-python"
    title: "Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-python: Python library to retrieve and parse agent-permissions.json (created 15 October 2025; last pushed 10 December 2025; checked 29 October 2026): \"Python library to retrieve and parse agent-permissions.json\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-18
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/README.md"
    title: "Lightweight Agent Standards Working Group, README.md in las-wg/agent-permissions-python (13 October 2025; checked 29 October 2026): \"This package provides utilities for discovering, fetching, validating, and enforcing agent-permissions.json manifest files exposed by websites. It is designed to plug into agentic frameworks that need to respect site-defined automation policies.\" \"For more detailed documentation, consult design/library.md.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-19
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/pyproject.toml"
    title: "Lightweight Agent Standards Working Group, pyproject.toml (agent-permissions v0.1.0) in las-wg/agent-permissions-python (11 October 2025; checked 29 October 2026): \"name = \"agent-permissions\" version = \"0.1.0\" description = \"Python tools for discovering, parsing, and enforcing agent-permissions manifests on the web.\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-20
    resource: "https://api.github.com/repos/las-wg/agent-permissions-python/commits?per_page=100"
    title: "GitHub REST API, las-wg/agent-permissions-python commit history (26 September 2025 – 10 December 2025; checked 29 October 2026): \"\"date\": \"2025-12-10T12:45:33Z\" }, \"message\": \"Harmonized with release version of schema.\"\" \"\"date\": \"2025-12-10T14:43:43Z\" }, \"message\": \"Simplified interaction checking.\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-21
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/__init__.py"
    title: "Lightweight Agent Standards Working Group, init.py in las-wg/agent-permissions-python/src/agent_permissions/ (checked 29 October 2026): \"all = [ \"fetch_manifest\", \"discover_manifest\", \"parse_manifest_from_html\", \"validate_interaction\", \"ensure_interaction_allowed\", \"build_prompt_instructions\", \"Manifest\", \"ValidationResult\", ]\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-22
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/config.py"
    title: "Lightweight Agent Standards Working Group, config.py in las-wg/agent-permissions-python/src/agent_permissions/ (checked 29 October 2026): \"http_timeout: float = 10.0 http_user_agent: str = (\"agent-permissions-python/0.1 (+https://example.com/agent-permissions)\") enable_cache: bool = True cache_ttl_seconds: int = 900\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-23
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/io/discovery.py"
    title: "Lightweight Agent Standards Working Group, discovery.py in las-wg/agent-permissions-python/src/agent_permissions/io/ (checked 29 October 2026): \"LINK_REL = \"agent-permissions\" DEFAULT_WELL_KNOWN_PATH = \"/.well-known/agent-permissions.json\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-24
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/data/agent-permissions.schema.json"
    title: "Lightweight Agent Standards Working Group, agent-permissions.schema.json bundled JSON Schema in las-wg/agent-permissions-python (10 December 2025; checked 29 October 2026): \"\"$schema\": \"http://json-schema.org/draft-07/schema#\", \"title\": \"Agent Permissions File\", \"type\": \"object\", \"required\": [\"metadata\", \"resource_rules\"]\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-25
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/models/manifest.py"
    title: "Lightweight Agent Standards Working Group, manifest.py Pydantic models in las-wg/agent-permissions-python/src/agent_permissions/models/ (10 December 2025; checked 29 October 2026): \"class APIReference(BaseModel): model_config = ConfigDict(extra=\"forbid\") type: str = Field(pattern=r\"^(openapi|mcp|a2a)$\") endpoint: HttpUrl description: str docs: Optional[HttpUrl] = None\" \"class Manifest(BaseModel): model_config = ConfigDict(extra=\"forbid\") metadata: ManifestMetadata resource_rules: List[ResourceRule] action_guidelines: List[ActionGuideline] = Field(default_factory=list) api: List[APIReference] = Field(default_factory=list)\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-26
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/validation/interaction_validator.py"
    title: "Lightweight Agent Standards Working Group, interaction_validator.py in las-wg/agent-permissions-python/src/agent_permissions/validation/ (10 December 2025; checked 29 October 2026): \"if matching_rule is None: return ValidationResult(allowed=False, matched_rule=None, reasons=[\"No matching resource rule\"],)\" \"# CSS specificity: higher tuple wins; if equal, later rules override. chosen_bucket.sort(key=lambda item: (item.to_list(), item)) return chosen_bucket[-1]\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-27
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/prompt/builder.py"
    title: "Lightweight Agent Standards Working Group, builder.py in las-wg/agent-permissions-python/src/agent_permissions/prompt/ (checked 29 October 2026): \"lines.append(f\"Respect the site's agent permissions (schema {meta.schema_version}, last updated {meta.last_updated.isoformat()}).\")\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-28
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/agent-permissions.json"
    title: "Lightweight Agent Standards Working Group, agent-permissions.json (DemoCo sample manifest, timestamped 2025-06-01T12:00:00Z) in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): \"\"metadata\": { \"schema_version\": \"1.0.0\", \"last_updated\": \"2025-06-01T12:00:00Z\", \"author\": \"DemoCo\" }\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-29
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/playwright_integration.py"
    title: "Lightweight Agent Standards Working Group, playwright_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): \"Async example integrating agent-permissions with Playwright.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-30
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/selenium_integration.py"
    title: "Lightweight Agent Standards Working Group, selenium_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): \"Example workflow integrating agent-permissions with Selenium.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-31
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/browseruse_integration.py"
    title: "Lightweight Agent Standards Working Group, browseruse_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): \"Illustrative example of integrating agent-permissions with BrowserUse.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-32
    resource: "https://github.com/las-wg/agent-permissions-generator"
    title: "Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-generator: Website to generate agent-permissions.json given a URL. (created 15 October 2025; last pushed 7 January 2026; checked 29 October 2026): \"Website to generate agent-permissions.json given a URL.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-33
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/README.md"
    title: "Lightweight Agent Standards Working Group, README.md (Agent Permissions Playground) in las-wg/agent-permissions-generator (7 January 2026; checked 29 October 2026): \"A small Next.js app for drafting, testing, and explaining agent-permissions.json files. You can try it live at https://agent-permissions-tools.vercel.app/.\" \"Retrieval is single-page only; links are not crawled. Robots.txt is respected when present.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-34
    resource: "https://api.github.com/repos/las-wg/agent-permissions-generator/commits?per_page=100"
    title: "GitHub REST API, las-wg/agent-permissions-generator commit history (1 October 2025 – 7 January 2026; checked 29 October 2026): \"\"date\": \"2026-01-07T16:06:54Z\" }, \"message\": \"README and minor fixes.\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-35
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/page.tsx"
    title: "Lightweight Agent Standards Working Group, page.tsx in las-wg/agent-permissions-generator/src/app/ (checked 29 October 2026): \"const policy = { metadata: { schema_version: \"1.0.0\", last_updated: now,\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-36
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/lib/crawl.ts"
    title: "Lightweight Agent Standards Working Group, crawl.ts in las-wg/agent-permissions-generator/src/lib/ (checked 29 October 2026): \"reason: \"Fetched landing page (single-page snapshot; links not followed)\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-37
    resource: "https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/api/generate/route.ts"
    title: "Lightweight Agent Standards Working Group, route.ts in las-wg/agent-permissions-generator/src/app/api/generate/ (checked 29 October 2026): \"const STANDARD_PATH = path.join(process.cwd(), \"design\", \"standard.md\");\" \"if (!standardContent) { notes.push(\"Unable to load local agent-permissions standard; proceeding without it.\"); }\" \"const model = \"gpt-5-mini\";\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-38
    resource: "https://agent-permissions-tools.vercel.app/"
    title: "Lightweight Agent Standards Working Group, Agent Permissions Generator live web deployment (checked 29 October 2026): \"Agent Permissions Generator\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-39
    resource: "https://scirate.com/arxiv/2601.02371"
    title: "SciRate, Permission Manifests for Web Agents bibliographic record for arXiv:2601.02371 (submitted 7 December 2025; published 7 January 2026; updated 12 January 2026; checked 29 October 2026): \"Submitted 07 Dec 2025 to Computers and Society [cs.CY] Published 07 Jan 2026 Updated 12 Jan 2026\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-40
    resource: "https://permissioning.ai/spec/v0.1.html"
    title: "Uljan Sinani, The Permissioning Protocol — v0.1 (Draft for Comment) | spec (updated 11 June 2026; checked 29 October 2026): \"A site or service publishes a single file at a well-known path: https://example.com/.well-known/agent-permissions.json 3.1 Minimal Example { \"permissioning_version\": \"0.1\", \"owner\": \"example.com\", \"updated\": \"2026-06-11\"\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-41
    resource: "https://www.ajarprotocol.org/docs/protocol/research"
    title: "Ajar Protocol, Research: Prior Art and Positioning | Ajar Protocol (snapshot date July 2026; checked 29 October 2026): \"A2A Agent Cards, MCP Server Cards (SEP-1649), NANDA AgentFacts, agent-permissions.json, robots.txt, sitemap.xml, llms.txt, UCP feeds — a site being \"agent-ready\" in 2026 means maintaining ~9 unsigned, uncoordinated files.\""
    last_modified: 2026-10-29T00:00:00Z
  - id: ref-42
    resource: "https://www.aibuddy.day/docs/en/etclovg/governance/"
    title: "aibuddy Docs, Governance and Security (G) · aibuddy Docs — §9 of Agent Harness Engineering: A Survey (checked 29 October 2026): \"Web-level permission coordination Site-declared action permissions and rate/confirmation requirements agent-permissions.json\""
    last_modified: 2026-10-29T00:00:00Z
---

# agent-permissions.json

agent-permissions.json is an agentic-web standard (well-known file — /.well-known/agent-permissions.json) at step 3, Permit, governed by Lightweight Agent Standards Working Group, chaired by Samuele Marro, governed by the LAS-WG Charter; its status is "Work-in-progress draft". It answers: "Which page-level interactions (clicking, form submission, file upload, media control, script execution) may an agent perform while driving a web page's UI, as opposed to just fetching it?" Implementation status is prototype, last verified 2026-10-29.

# Overview

**`agent-permissions.json`** (titled **`Agent Permissions File`** in its JSON Schema) is an MIT-licensed, work-in-progress JSON manifest format proposed by the **Lightweight Agent Standards Working Group (LAS-WG)** through which websites declare advisory, machine-readable rules governing how browser-based AI agents interact with HTML elements, interpret natural-language behavioral norms, and discover structured API alternatives [^ref-1][^ref-2][^ref-6][^ref-8]. Published by default at `/.well-known/agent-permissions.json` or selected per page via an HTML `<link rel="agent-permissions" href="...">` element, the manifest separates deterministic DOM-level interaction rules (`resource_rules` using CSS selectors, a closed vocabulary of interaction verbs, and rate/concurrency/oversight modifiers) from agent-level normative instructions (`action_guidelines` using RFC 2119 directives) and structured service pointers (`api` advertising OpenAPI, Model Context Protocol, or Agent-to-Agent endpoints) [^ref-2][^ref-8].

### Rationale and architectural positioning

Modern browser-based AI agents interact with web applications by clicking controls, filling and submitting forms, scrolling viewports, controlling media playback, and executing multi-step UI workflows rather than merely fetching static documents for indexing [^ref-2][^ref-8]. In `las-wg/agent-permissions.json`, LAS-WG frames the specification as `A robots.txt-inspired standard for how agents may interact with webpages.` and explains its scope in the specification introduction [^ref-2]:

> "Websites need a machine-readable, non-binding way to declare how automated agents (bots, crawlers, assistants) may interact with them. This JSON-only Agent Permissions File lets sites express fine-grained resource-level rules and higher-level action guidelines in a single, versioned document." [^ref-2]

Both the specification and the companion paper *Permission Manifests for Web Agents* (`arXiv:2601.02371`) distinguish UI-interaction governance from adjacent web standards [^ref-2][^ref-8]:

- **Crawler exclusion (`robots.txt`):** While `robots.txt` communicates path-level allow, disallow, and crawl-delay rules for indexing crawlers, it cannot express whether an agent may click a specific button, fill an input field, or submit a form only after human confirmation [^ref-8].
- **Curated reading (`llms.txt`):** As the paper notes when comparing [llms.txt](https://agenticweb.wiki/protocols/llms-txt/), `llms.txt helps agents read a site efficiently, but not interact with it responsibly.` [^ref-8].
- **Content-usage and training preferences (`AIPref` and `TDMRep`):** The specification states that `This document does not cover agent-to-agent interactions or content usage policies (see IETF AIPref instead).` [^ref-2], and the paper summarizes the separation across layers: `We therefore treat AIPref and TDMRep as an adjacent layer in a broader stack: content-use signals govern what models may do with data, while our permission manifest governs how agents may behave on pages.` [^ref-8].
- **Monetization (`Pay per Crawl`, `x402`, `AP2`):** Contrasting permission manifests with payment-gated crawling, the paper observes that `Compared to Pay per Crawl, agent-permissions.json addresses a different problem: specifying permissible interactions rather than monetizing access.` [^ref-8].

The manifest is explicitly a voluntary coordination layer rather than an cryptographic access-control boundary [^ref-2][^ref-8]:

> "This file is advisory and non-binding: agents MAY choose stricter behaviors than those granted here, but MUST NOT exceed the permissions granted if they claim to honor this format." [^ref-2]

In Section 4.1 of the paper, the authors argue that decoupling declarative permissions from site-side enforcement (such as rate shaping, WAF rules, or attestation) establishes an explicit baseline against which enforcement systems can evaluate traffic [^ref-8]:

> "In other words, the question for the enforcement system shifts from "is the agent operating with a malicious intent?" to "is the agent following the rules in agent-permissions.json?"" [^ref-8]

### Discovery and resolution order

The specification defines two discovery mechanisms — a page-level HTML `<link>` element and a root well-known URI fallback [^ref-2][^ref-8]:

> "Consumers MAY locate and fetch the JSON policy via a link tag, e.g.: <link rel="agent-permissions" href="https://example.com/path/to/agent-permissions.json"> In case of no <link> tag, the default path is /.well-known/agent-permissions.json. Servers SHOULD serve this file with Content-Type: application/json." [^ref-2]

In Section 3.1 of *Permission Manifests for Web Agents*, the authors state that the `<link rel="agent-permissions" href="https://…">` tag overrides the root `/.well-known/agent-permissions.json` file so site operators can attach custom rules to a specific page while retaining the root manifest as the site-wide default [^ref-8]. Neither the specification nor the reference Python library defines a rule-merging or inheritance algorithm between a page-linked manifest and the root well-known manifest: in `las-wg/agent-permissions-python` (`src/agent_permissions/__init__.py` and `src/agent_permissions/io/resolvers.py`), `discover_manifest()` checks `<link rel="agent-permissions">` first (`method="html_link_tag"`) and queries `/.well-known/agent-permissions.json` (`method="default_well_known"`) only if no link-referenced manifest is found or if loading the link target raises an `AgentPermissionsError` [^ref-21][^ref-23].

### Top-level JSON Schema structure and the `strict` schema divergence

The specification `README.md` embeds a Draft-07 JSON Schema (`"$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "strict"]`) whose root object sets `"additionalProperties": false` and defines five top-level properties [^ref-2]:

1. **`metadata` (required object, `additionalProperties: false`):** Requires `schema_version` (`type: "string"`, matching regex `^\d+\.\d+\.\d+$`) and `last_updated` (`type: "string"`, `format: "date-time"`), and accepts optional `author` (`type: "string"`) [^ref-2].
2. **`strict` (required boolean in `README.md`):** Prescribes the fallback policy for any interaction not matched by an explicit rule: `The top-level field strict prescribes the default behavior for an action that is not explicitly allowed or forbidden (true: defaults to forbidden, false: defaults to allowed).` [^ref-2].
3. **`resource_rules` (optional array):** Ordered list of element-level interaction rules, each requiring `verb`, `selector`, and `allowed`, with optional `modifiers` and `additionalProperties: false` [^ref-2].
4. **`action_guidelines` (optional array):** List of natural-language behavioral rules, each requiring `directive` and `description`, with optional `exceptions` and `additionalProperties: false` [^ref-2].
5. **`api` (optional array):** List of structured endpoint descriptors, each requiring `type`, `endpoint`, and `description`, with optional `docs` and `additionalProperties: false` [^ref-2].

Inspection of the LAS-WG repositories and paper reveals an important schema synchronization discrepancy across the project's own artifacts [^ref-2][^ref-4][^ref-8][^ref-20][^ref-24][^ref-25][^ref-35]:

- In `las-wg/agent-permissions.json`, the required top-level `strict` boolean was added on 10 December 2025 at `22:53:58Z` (`"date": "2025-12-10T22:53:58Z" }, "message": "Add 'strict' field to agent permissions schema\n\nAdded a 'strict' field to define default action behavior."`), changing the root schema's `"required"` array to `["metadata", "strict"]` and making `resource_rules` optional [^ref-2][^ref-4].
- Both `v1` (`7 December 2025`) and `v2` (`12 January 2026`) of the arXiv paper predate or omit that schema change in prose, stating in Section 3.1: `The file contains four top-level fields: • metadata (mandatory): basic information including schema version, last update timestamp, and document author; • resource_rules (mandatory): rules governing how agents may interact with HTML elements (Section 3.3).` [^ref-8][^ref-9].
- In `las-wg/agent-permissions-python`, the final schema-harmonization commit (`"date": "2025-12-10T12:45:33Z" }, "message": "Harmonized with release version of schema."`) and final code commit (`"date": "2025-12-10T14:43:43Z" }, "message": "Simplified interaction checking."`) landed earlier on 10 December 2025, eight hours before `strict` was added to the specification repository [^ref-4][^ref-20]. Consequently, the library's bundled JSON Schema (`src/agent_permissions/data/agent-permissions.schema.json`) still declares `"$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "resource_rules"]` with `"additionalProperties": false` and no `strict` property [^ref-24], and its Pydantic v2 model (`src/agent_permissions/models/manifest.py`) defines `class Manifest(BaseModel): model_config = ConfigDict(extra="forbid") metadata: ManifestMetadata resource_rules: List[ResourceRule] action_guidelines: List[ActionGuideline] = Field(default_factory=list) api: List[APIReference] = Field(default_factory=list)` [^ref-25]. Because both validators forbid extra properties, any manifest containing the `"strict"` field required by the specification `README.md` fails validation in `las-wg/agent-permissions-python`, while any manifest omitting `"strict"` (including the library's `samples/agent-permissions.json` and policies emitted by `buildQuickPolicy()` in `las-wg/agent-permissions-generator/src/app/page.tsx`) fails validation against the specification `README.md` schema [^ref-2][^ref-24][^ref-25][^ref-28][^ref-35].

### `resource_rules`: selectors, verbs, modifiers, and CSS specificity priority

The specification separates element-level rules from workflow-level guidelines [^ref-2][^ref-8]:

> "There are two forms of permissions: Resource permissions: how you can interact with HTML elements (clicking, following links, filling forms, controlling media, uploading files…). Action permissions: what you can do on the web page (sending DMs, booking a flight, posting content…)." [^ref-2]

In Section 3.2 of the paper, the authors cite authenticated-delegation research to motivate this split: `A core design principle of the manifest is that automated interactions operate along two complementary dimensions: interactions with specific resources and general actions (South et al., 2025).` [^ref-8]. Each item in `resource_rules` pairs a CSS `selector` string (XPath selectors were removed on 4 December 2025 in commit `939b6431`, `"date": "2025-12-04T01:18:49Z" }, "message": "Dropped XPath support."`) with a boolean `allowed` flag and a `verb` from a closed enumeration [^ref-2][^ref-4]:

> "The verb in each resource_rules entry MUST be one of the following values. Future versions MAY extend this list; unknown verbs MUST be treated as disallowed." [^ref-2]

The permitted `verb` values in the specification schema are `all` (wildcard for all verbs), `read_content` (human-visible body text, headings, and labels), `read_metadata` (`<title>`, `<meta>`, OpenGraph, JSON-LD), `follow_link` (activating `<a>` elements to navigate), `click_element` (synthesizing a click on buttons, links, or controls), `scroll_page`, `set_input_value` (setting text/number inputs, checkboxes, radio buttons, or dropdowns), `submit_form` (submitting the enclosing `<form>`), `execute_script` (executing JavaScript in page context), `play_media`, `pause_media`, `mute_media`, `unmute_media`, `upload_file` (attaching files to `<input type="file">`), `download_file`, and `copy_to_clipboard` [^ref-2]. Higher-level UI workflows are modeled as sequences of primitive verbs: `Some higher-level behaviors (for example, "fill this form") are expected to be composite operations built from primitive verbs (e.g. multiple set_input_value calls followed by submit_form).` [^ref-2].

Each resource rule may include a `modifiers` object (`additionalProperties: false`) with up to four optional constraints [^ref-2]:

- **`burst`:** Positive integer (`minimum: 1`) capping concurrent executions of the action by an agent instance [^ref-2].
- **`rate_limit`:** Object (`additionalProperties: false`) containing `max_requests` (`integer`, `minimum: 1`) and `window_seconds` (`integer`, `minimum: 1`) [^ref-2].
- **`time_window`:** UTC clock-time range string validated against `^[0-2]\d:[0-5]\d-[0-2]\d:[0-5]\d UTC$` (for example, `"08:00-20:00 UTC"`) [^ref-2].
- **`human_in_the_loop`:** Boolean (`true` requires explicit human confirmation before executing the action) [^ref-2].

When multiple `resource_rules` match a target DOM element, the specification prescribes two priority rules [^ref-2]:

> "Apply resource_rules following priority rules: Specific verbs have higher priority over all For the same verb, follow CSS priority rules" [^ref-2]

In the reference implementation (`src/agent_permissions/validation/interaction_validator.py`), `_find_matching_rule()` partitions matching selectors into `verb_specific_rules` (exact verb match) and `wildcard_rules` (`verb == "all"`), selects `verb_specific_rules` if non-empty, computes each selector's CSS specificity tuple via `SpecificityCalculator.calculate(selector)`, and breaks equal-specificity ties by selecting the rule that appears later in the `resource_rules` array (`# CSS specificity: higher tuple wins; if equal, later rules override. chosen_bucket.sort(key=lambda item: (item[^ref-1].to_list(), item[^ref-2])) return chosen_bucket[-1][^ref-0]`) [^ref-26].

### `action_guidelines`, `api` references, and enforcement boundaries

For norms that cannot be reduced to individual DOM elements, `action_guidelines` entries combine an RFC 2119 `directive` (`"MUST"`, `"MUST NOT"`, `"SHOULD"`, or `"SHOULD NOT"`) with a natural-language `description` and optional `exceptions` string [^ref-2][^ref-8]. The specification maps violations to logging severities (`MUST NOT` → error log, `SHOULD NOT` → warning, `SHOULD` → info) and assigns `resource_rules` and `action_guidelines` to separate architectural layers [^ref-2]:

> "We expect the implementation of resource_rules to happen at the browser interface level (e.g. the agent is blocked from performing unintended interactions) and the implementation of action_guidelines to happen at the agent level (e.g. by feeding these rules to the LLM or equivalent decision component)." [^ref-2]

Because `action_guidelines` are injected into an LLM's context window (via `build_prompt_instructions()` in `src/agent_permissions/prompt/builder.py`), Section 4.2 of the paper explicitly warns against prompt injection through malicious manifests [^ref-8][^ref-27]:

> "Since action guidelines are expressed in natural language, a malicious or adversarial site could attempt to use them as a channel for prompt injection or manipulation of agent behavior. Frameworks should therefore treat manifest content as untrusted input" [^ref-8]

The optional `api` array allows publishers to advertise structured endpoints alongside DOM rules (`Finally, the field api provides information on what actions can be performed by calling HTTP APIs (e.g. REST) instead of interacting with the website, as the former is often more efficient and reliable than the latter.`), supporting `type` values of `"openapi"`, `"mcp"`, and `"a2a"` (`agent-permissions.json provides native support for advertising MCP and A2A endpoints alongside OpenAPI specifications (see Section 3.5).`) [^ref-2][^ref-8]. As Section 3.5 of the paper states: `The manifest therefore treats APIs as the "happy path" but not the sole path. Agents are encouraged to use APIs when possible, but may fall back to DOM-level interactions when necessary.` [^ref-8]. Notably, while the specification schema types `endpoint` and `docs` as plain strings and illustrates `"endpoint": "mcp://example/agents"` in Figure 2(c) of the paper, the Pydantic model in `las-wg/agent-permissions-python` (`src/agent_permissions/models/manifest.py`) declares `class APIReference(BaseModel): model_config = ConfigDict(extra="forbid") type: str = Field(pattern=r"^(openapi|mcp|a2a)$") endpoint: HttpUrl description: str docs: Optional[HttpUrl] = None`, which rejects `mcp://` URIs under Pydantic `HttpUrl` validation [^ref-2][^ref-8][^ref-25]. On any schema or model validation failure, the specification mandates fail-closed fallback to the agent's baseline safety policy [^ref-2]:

> "Parse according to the schema; on validation failure, consumers SHOULD treat the file as absent and MUST NOT grant additional permissions based on it (i.e., disallow all interactions beyond their default safety policies)." [^ref-2]

# Examples

```http
GET {origin}/.well-known/agent-permissions.json
# parse: Valid JSON with top-level 'metadata' (schema_version, last_updated) and 'strict' boolean fields present, per the LAS-WG JSON Schema
# on absent: No agent-permissions.json at the well-known path; also check the page's HTML for a <link rel="agent-permissions"> override before concluding the site has not published page-action permissions
```

# Knowledge Graph

* **Lifecycle Step**: [3 Permit](/category/permit/index.md)
* **Pairs with**: [AI crawler tokens in robots.txt](/okf/protocols/ai-crawler-tokens-robots.md), [AIPREF Vocabulary (A Vocabulary For Expressing AI Usage Preferences)](/okf/protocols/aipref-vocabulary.md), [TDMRep (TDM Reservation Protocol)](/okf/protocols/tdmrep.md), [Content Signals Policy](/okf/protocols/cloudflare-content-signals-policy.md), [agents.json](/okf/protocols/agents-json.md), [WebMCP](/okf/protocols/webmcp.md)
* **Compared in**: [AI crawler tokens in robots.txt vs agent-permissions.json](/compare/ai-crawler-tokens-robots-vs-agent-permissions-json/index.md), [agent-permissions.json vs auth.md](/compare/agent-permissions-json-vs-auth-md/index.md)

[^ref-1]: Lightweight Agent Standards Working Group (LAS-WG), GitHub - las-wg/agent-permissions.json: robots.txt-style permission manifest for web agents (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): "robots.txt-style permission manifest for web agents" (https://github.com/las-wg/agent-permissions.json)
[^ref-2]: Lightweight Agent Standards Working Group (LAS-WG), README.md — agent-permissions.json specification in las-wg/agent-permissions.json (commit 44ce979a, 10 December 2025; checked 29 October 2026): "A robots.txt-inspired standard for how agents may interact with webpages." "Note: This standard is still WIP!" "Websites need a machine-readable, non-binding way to declare how automated agents (bots, crawlers, assistants) may interact with them. This JSON-only Agent Permissions File lets sites express fine-grained resource-level rules and higher-level action guidelines in a single, versioned document." "This document does not cover agent-to-agent interactions or content usage policies (see IETF AIPref instead)." "This file is advisory and non-binding: agents MAY choose stricter behaviors than those granted here, but MUST NOT exceed the permissions granted if they claim to honor this format." "Consumers MAY locate and fetch the JSON policy via a link tag, e.g.:" "In case of no <link> tag, the default path is /.well-known/agent-permissions.json. Servers SHOULD serve this file with Content-Type: application/json." "There are two forms of permissions: Resource permissions: how you can interact with HTML elements (clicking, following links, filling forms, controlling media, uploading files…). Action permissions: what you can do on the web page (sending DMs, booking a flight, posting content…)." "The top-level field strict prescribes the default behavior for an action that is not explicitly allowed or forbidden (true: defaults to forbidden, false: defaults to allowed)." "Implementation-wise, agents can follow resource_rules at the interface level (e.g. if the agent is using a headless browser to perform an action, the code connecting the agent to the browser can act as an enforcement layer), while action_guidelines are provided as prompt or configuration to the agent." "Some higher-level behaviors (for example, "fill this form") are expected to be composite operations built from primitive verbs (e.g. multiple set_input_value calls followed by submit_form)." "Finally, the field api provides information on what actions can be performed by calling HTTP APIs (e.g. REST) instead of interacting with the website, as the former is often more efficient and reliable than the latter." "The verb in each resource_rules entry MUST be one of the following values. Future versions MAY extend this list; unknown verbs MUST be treated as disallowed." ""$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "strict"]" "Parse according to the schema; on validation failure, consumers SHOULD treat the file as absent and MUST NOT grant additional permissions based on it (i.e., disallow all interactions beyond their default safety policies)." "Apply resource_rules following priority rules: 1. Specific verbs have higher priority over all 2. For the same verb, follow CSS priority rules" "We expect the implementation of resource_rules to happen at the browser interface level (e.g. the agent is blocked from performing unintended interactions) and the implementation of action_guidelines to happen at the agent level (e.g. by feeding these rules to the LLM or equivalent decision component)." (https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/README.md)
[^ref-3]: GitHub REST API, las-wg/agent-permissions.json repository metadata (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): ""created_at": "2025-08-05T23:47:17Z", "updated_at": "2026-06-22T15:31:01Z", "pushed_at": "2025-12-10T22:53:58Z"" (https://api.github.com/repos/las-wg/agent-permissions.json)
[^ref-4]: GitHub REST API, las-wg/agent-permissions.json commit history (5 August 2025 – 10 December 2025; checked 29 October 2026): ""date": "2025-12-10T22:53:58Z" }, "message": "Add 'strict' field to agent permissions schema" "Added a 'strict' field to define default action behavior."" ""date": "2025-12-04T01:18:49Z" }, "message": "Dropped XPath support."" ""date": "2025-11-27T23:04:01Z" }, "message": "Update to v0.3 draft."" ""date": "2025-08-05T23:47:17Z" }, "message": "Initial commit"" (https://api.github.com/repos/las-wg/agent-permissions.json/commits?per_page=100)
[^ref-5]: GitHub REST API, samuelemarro contributor statistics on las-wg/agent-permissions.json (checked 29 October 2026): ""login": "samuelemarro", "id": 13946873, "node_id": "MDQ6VXNlcjEzOTQ2ODcz", "avatar_url": "https://avatars.githubusercontent.com/u/13946873?v=4", "gravatar_id": "", "url": "https://api.github.com/users/samuelemarro", "html_url": "https://github.com/samuelemarro", "followers_url": "https://api.github.com/users/samuelemarro/followers", "following_url": "https://api.github.com/users/samuelemarro/following{/other_user}", "gists_url": "https://api.github.com/users/samuelemarro/gists{/gist_id}", "starred_url": "https://api.github.com/users/samuelemarro/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/samuelemarro/subscriptions", "organizations_url": "https://api.github.com/users/samuelemarro/orgs", "repos_url": "https://api.github.com/users/samuelemarro/repos", "events_url": "https://api.github.com/users/samuelemarro/events{/privacy}", "received_events_url": "https://api.github.com/users/samuelemarro/received_events", "type": "User", "user_view_type": "public", "site_admin": false, "contributions": 9" (https://api.github.com/repos/las-wg/agent-permissions.json/contributors)
[^ref-6]: Lightweight Agent Standards Working Group (LAS-WG), LICENSE (MIT License) in las-wg/agent-permissions.json (6 August 2025; checked 29 October 2026): "MIT License Copyright (c) 2025 Lightweight Agent Standard Working Group (LAS-WG)" (https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/LICENSE)
[^ref-7]: Samuele Marro et al. (Lightweight Agent Standards Working Group), [2601.02371] Permission Manifests for Web Agents, arXiv abstract and submission history (v1 submitted 7 December 2025; v2 revised 12 January 2026; checked 29 October 2026): "[v1] Sun, 7 Dec 2025 17:45:01 UTC (207 KB) [v2] Mon, 12 Jan 2026 23:23:48 UTC (208 KB)" "Subjects: Computers and Society (cs.CY); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA); Networking and Internet Architecture (cs.NI)" (https://arxiv.org/abs/2601.02371)
[^ref-8]: Samuele Marro, Alan Chan, Xinxing Ren, Lewis Hammond, Jesse Wright, Gurjyot Wanga, Tiziano Piccardi, Nuno Campos, Tobin South, Jialin Yu, Sunando Sengupta, Eric Sommerlade, Alex Pentland, Philip Torr, and Jiaxin Pei (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, arXiv:2601.02371v2 HTML edition (12 January 2026; manuscript dated August 2025; checked 29 October 2026): "arXiv:2601.02371v2 [cs.CY] 12 Jan 2026 Permission Manifests for Web Agents Lightweight Agent Standards Working Group (LAS-WG)" "Tobin South Jialin Yu Sunando Sengupta Eric Sommerlade Alex Pentland Philip Torr Jiaxin Pei Affiliation: Stanford University Microsoft UT Austin August 2025" "We introduce agent-permissions.json, a robots.txt -style lightweight manifest where websites specify allowed interactions, complemented by API references where available." "llms.txt helps agents read a site efficiently, but not interact with it responsibly." "We therefore treat AIPref and TDMRep as an adjacent layer in a broader stack: content-use signals govern what models may do with data, while our permission manifest governs how agents may behave on pages." "Compared to Pay per Crawl, agent-permissions.json addresses a different problem: specifying permissible interactions rather than monetizing access." "agent-permissions.json provides native support for advertising MCP and A2A endpoints alongside OpenAPI specifications (see Section 3.5)." "The file contains four top-level fields: • metadata (mandatory): basic information including schema version, last update timestamp, and document author; • resource_rules (mandatory): rules governing how agents may interact with HTML elements (Section 3.3)." "A core design principle of the manifest is that automated interactions operate along two complementary dimensions: interactions with specific resources and general actions (South et al., 2025)." "The manifest therefore treats APIs as the "happy path" but not the sole path. Agents are encouraged to use APIs when possible, but may fall back to DOM-level interactions when necessary." "In other words, the question for the enforcement system shifts from "is the agent operating with a malicious intent?" to "is the agent following the rules in agent-permissions.json?"" "Since action guidelines are expressed in natural language, a malicious or adversarial site could attempt to use them as a channel for prompt injection or manipulation of agent behavior. Frameworks should therefore treat manifest content as untrusted input" "Since most agents rely on headless browser automation (e.g., Selenium, Playwright, and Puppeteer) to interact with websites, we can apply resource rules at the browser interface layer. The mechanism is simple: when the agent attempts an interaction, the driver checks the manifest before issuing the corresponding DOM command. If the action is disallowed, the attempt is blocked." "Samuele Marro is supported by the EPSRC Centre for Doctoral Training in Autonomous Intelligent Machines and Systems n. EP/Y035070/1, in addition to Microsoft Ltd." (https://arxiv.org/html/2601.02371v2)
[^ref-9]: Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, arXiv:2601.02371v1 HTML edition (7 December 2025; checked 29 October 2026): "Tobin South Jialin Yu Alex Pentland Philip Torr Jiaxin Pei Affiliation: Anthropic Stanford University UT Austin August 2025" (https://arxiv.org/html/2601.02371v1)
[^ref-10]: Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents (arXiv:2601.02371v2 PDF edition — author list and typeset superscripts Samuele Marro1,2∗, Alan Chan3, Xinxing Ren4, Lewis Hammond1,5, Jesse Wright1,2, Gurjyot Wanga6, Tiziano Piccardi7, Nuno Campos8, Tobin South9,2, Jialin Yu1,2, Sunando Sengupta10, Eric Sommerlade10, Alex Pentland9, Philip Torr1,2, Jiaxin Pei11,9,2, 12 January 2026; checked 29 October 2026): "Samuele Marro; Alan Chan; Xinxing Ren; Lewis Hammond; Jesse Wright; Gurjyot Wanga; Tiziano Piccardi; Nuno Campos; Tobin South; Jialin Yu; Sunando Sengupta; Eric Sommerlade; Alex Pentland; Philip Torr; Jiaxin Pei" (https://arxiv.org/pdf/2601.02371v2)
[^ref-11]: Lightweight Agent Standards Working Group, LAS-WG | Lightweight Agent Standard Working Group official website (checked 29 October 2026): "LAS-WG develops interoperable standards for agent communication avoiding bloated protocols in favor of quick, iterative testing." (https://las-wg.org/)
[^ref-12]: GitHub REST API, las-wg/agent-permissions.json in orgs/las-wg/repos organization repository inventory (5 March 2025 – 15 January 2026; checked 29 October 2026): ""full_name": "las-wg/agent-permissions.json", "private": false, "owner": { "login": "las-wg", "id": 202027760, "node_id": "O_kgDODAqy8A", "avatar_url": "https://avatars.githubusercontent.com/u/202027760?v=4", "gravatar_id": "", "url": "https://api.github.com/users/las-wg", "html_url": "https://github.com/las-wg", "followers_url": "https://api.github.com/users/las-wg/followers", "following_url": "https://api.github.com/users/las-wg/following{/other_user}", "gists_url": "https://api.github.com/users/las-wg/gists{/gist_id}", "starred_url": "https://api.github.com/users/las-wg/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/las-wg/subscriptions", "organizations_url": "https://api.github.com/users/las-wg/orgs", "repos_url": "https://api.github.com/users/las-wg/repos", "events_url": "https://api.github.com/users/las-wg/events{/privacy}", "received_events_url": "https://api.github.com/users/las-wg/received_events", "type": "Organization", "user_view_type": "public", "site_admin": false }, "html_url": "https://github.com/las-wg/agent-permissions.json", "description": "robots.txt-style permission manifest for web agents"" (https://api.github.com/orgs/las-wg/repos)
[^ref-13]: Lightweight Agent Standards Working Group, README.md in las-wg/info (checked 29 October 2026): "LAS-WG develops interoperable standards for agent communication. We address concrete, immediate challenges by defining clear, focused guidelines that enhance consistency across the industry." (https://raw.githubusercontent.com/las-wg/info/master/README.md)
[^ref-14]: Lightweight Agent Standards Working Group, charter.md — Lightweight Agent Standard Working Group (LAS-WG) Charter in las-wg/info (checked 29 October 2026): "The LAS-WG focuses exclusively on the standardization of specific, clearly defined problems within agent-to-agent communication, agent operation, and agent-to-world communication." "Votes are decided by simple relative majority, typically lasting one week unless a longer period is specified by the Chair. All voting processes are public, with each member organization holding exactly one vote cast by their designated representative." "All LAS-WG outputs and standards shall be licensed under Creative Commons BY 4.0 or an equivalently permissive license." (https://raw.githubusercontent.com/las-wg/info/master/charter.md)
[^ref-15]: Lightweight Agent Standards Working Group, voting-members.md in las-wg/info (checked 29 October 2026): "The following organizations have voting rights: - AgentOps - Agora Protocol - Agent Network Protocol - Camel AI - Centre for the Governance of AI - Cosmos Institute - LangChain - Massachusetts Institute of Technology - Stanford University - University of Oxford - Wildcard" (https://raw.githubusercontent.com/las-wg/info/master/voting-members.md)
[^ref-16]: Samuele Marro, cv | Samuele Marro — academic curriculum vitae (March 2025 – present; checked 29 October 2026): "Mar 2025 - Present Chair Lightweight Agent Standards Working Group Industry-academia joint working group, focused on designing and iterating quickly on standards for agent interactions. Notable organizations: Oxford University, Stanford University, MIT, Firecrawl." (https://samuelemarro.it/cv/)
[^ref-17]: Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-python: Python library to retrieve and parse agent-permissions.json (created 15 October 2025; last pushed 10 December 2025; checked 29 October 2026): "Python library to retrieve and parse agent-permissions.json" (https://github.com/las-wg/agent-permissions-python)
[^ref-18]: Lightweight Agent Standards Working Group, README.md in las-wg/agent-permissions-python (13 October 2025; checked 29 October 2026): "This package provides utilities for discovering, fetching, validating, and enforcing agent-permissions.json manifest files exposed by websites. It is designed to plug into agentic frameworks that need to respect site-defined automation policies." "For more detailed documentation, consult design/library.md." (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/README.md)
[^ref-19]: Lightweight Agent Standards Working Group, pyproject.toml (agent-permissions v0.1.0) in las-wg/agent-permissions-python (11 October 2025; checked 29 October 2026): "name = "agent-permissions" version = "0.1.0" description = "Python tools for discovering, parsing, and enforcing agent-permissions manifests on the web."" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/pyproject.toml)
[^ref-20]: GitHub REST API, las-wg/agent-permissions-python commit history (26 September 2025 – 10 December 2025; checked 29 October 2026): ""date": "2025-12-10T12:45:33Z" }, "message": "Harmonized with release version of schema."" ""date": "2025-12-10T14:43:43Z" }, "message": "Simplified interaction checking."" (https://api.github.com/repos/las-wg/agent-permissions-python/commits?per_page=100)
[^ref-21]: Lightweight Agent Standards Working Group, init.py in las-wg/agent-permissions-python/src/agent_permissions/ (checked 29 October 2026): "all = [ "fetch_manifest", "discover_manifest", "parse_manifest_from_html", "validate_interaction", "ensure_interaction_allowed", "build_prompt_instructions", "Manifest", "ValidationResult", ]" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/__init__.py)
[^ref-22]: Lightweight Agent Standards Working Group, config.py in las-wg/agent-permissions-python/src/agent_permissions/ (checked 29 October 2026): "http_timeout: float = 10.0 http_user_agent: str = ("agent-permissions-python/0.1 (+https://example.com/agent-permissions)") enable_cache: bool = True cache_ttl_seconds: int = 900" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/config.py)
[^ref-23]: Lightweight Agent Standards Working Group, discovery.py in las-wg/agent-permissions-python/src/agent_permissions/io/ (checked 29 October 2026): "LINK_REL = "agent-permissions" DEFAULT_WELL_KNOWN_PATH = "/.well-known/agent-permissions.json"" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/io/discovery.py)
[^ref-24]: Lightweight Agent Standards Working Group, agent-permissions.schema.json bundled JSON Schema in las-wg/agent-permissions-python (10 December 2025; checked 29 October 2026): ""$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "resource_rules"]" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/data/agent-permissions.schema.json)
[^ref-25]: Lightweight Agent Standards Working Group, manifest.py Pydantic models in las-wg/agent-permissions-python/src/agent_permissions/models/ (10 December 2025; checked 29 October 2026): "class APIReference(BaseModel): model_config = ConfigDict(extra="forbid") type: str = Field(pattern=r"^(openapi|mcp|a2a)$") endpoint: HttpUrl description: str docs: Optional[HttpUrl] = None" "class Manifest(BaseModel): model_config = ConfigDict(extra="forbid") metadata: ManifestMetadata resource_rules: List[ResourceRule] action_guidelines: List[ActionGuideline] = Field(default_factory=list) api: List[APIReference] = Field(default_factory=list)" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/models/manifest.py)
[^ref-26]: Lightweight Agent Standards Working Group, interaction_validator.py in las-wg/agent-permissions-python/src/agent_permissions/validation/ (10 December 2025; checked 29 October 2026): "if matching_rule is None: return ValidationResult(allowed=False, matched_rule=None, reasons=["No matching resource rule"],)" "# CSS specificity: higher tuple wins; if equal, later rules override. chosen_bucket.sort(key=lambda item: (item.to_list(), item)) return chosen_bucket[-1]" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/validation/interaction_validator.py)
[^ref-27]: Lightweight Agent Standards Working Group, builder.py in las-wg/agent-permissions-python/src/agent_permissions/prompt/ (checked 29 October 2026): "lines.append(f"Respect the site's agent permissions (schema {meta.schema_version}, last updated {meta.last_updated.isoformat()}).")" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/prompt/builder.py)
[^ref-28]: Lightweight Agent Standards Working Group, agent-permissions.json (DemoCo sample manifest, timestamped 2025-06-01T12:00:00Z) in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): ""metadata": { "schema_version": "1.0.0", "last_updated": "2025-06-01T12:00:00Z", "author": "DemoCo" }" (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/agent-permissions.json)
[^ref-29]: Lightweight Agent Standards Working Group, playwright_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): "Async example integrating agent-permissions with Playwright." (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/playwright_integration.py)
[^ref-30]: Lightweight Agent Standards Working Group, selenium_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): "Example workflow integrating agent-permissions with Selenium." (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/selenium_integration.py)
[^ref-31]: Lightweight Agent Standards Working Group, browseruse_integration.py in las-wg/agent-permissions-python/samples/ (checked 29 October 2026): "Illustrative example of integrating agent-permissions with BrowserUse." (https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/browseruse_integration.py)
[^ref-32]: Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-generator: Website to generate agent-permissions.json given a URL. (created 15 October 2025; last pushed 7 January 2026; checked 29 October 2026): "Website to generate agent-permissions.json given a URL." (https://github.com/las-wg/agent-permissions-generator)
[^ref-33]: Lightweight Agent Standards Working Group, README.md (Agent Permissions Playground) in las-wg/agent-permissions-generator (7 January 2026; checked 29 October 2026): "A small Next.js app for drafting, testing, and explaining agent-permissions.json files. You can try it live at https://agent-permissions-tools.vercel.app/." "Retrieval is single-page only; links are not crawled. Robots.txt is respected when present." (https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/README.md)
[^ref-34]: GitHub REST API, las-wg/agent-permissions-generator commit history (1 October 2025 – 7 January 2026; checked 29 October 2026): ""date": "2026-01-07T16:06:54Z" }, "message": "README and minor fixes."" (https://api.github.com/repos/las-wg/agent-permissions-generator/commits?per_page=100)
[^ref-35]: Lightweight Agent Standards Working Group, page.tsx in las-wg/agent-permissions-generator/src/app/ (checked 29 October 2026): "const policy = { metadata: { schema_version: "1.0.0", last_updated: now," (https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/page.tsx)
[^ref-36]: Lightweight Agent Standards Working Group, crawl.ts in las-wg/agent-permissions-generator/src/lib/ (checked 29 October 2026): "reason: "Fetched landing page (single-page snapshot; links not followed)"" (https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/lib/crawl.ts)
[^ref-37]: Lightweight Agent Standards Working Group, route.ts in las-wg/agent-permissions-generator/src/app/api/generate/ (checked 29 October 2026): "const STANDARD_PATH = path.join(process.cwd(), "design", "standard.md");" "if (!standardContent) { notes.push("Unable to load local agent-permissions standard; proceeding without it."); }" "const model = "gpt-5-mini";" (https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/api/generate/route.ts)
[^ref-38]: Lightweight Agent Standards Working Group, Agent Permissions Generator live web deployment (checked 29 October 2026): "Agent Permissions Generator" (https://agent-permissions-tools.vercel.app/)
[^ref-39]: SciRate, Permission Manifests for Web Agents bibliographic record for arXiv:2601.02371 (submitted 7 December 2025; published 7 January 2026; updated 12 January 2026; checked 29 October 2026): "Submitted 07 Dec 2025 to Computers and Society [cs.CY] Published 07 Jan 2026 Updated 12 Jan 2026" (https://scirate.com/arxiv/2601.02371)
[^ref-40]: Uljan Sinani, The Permissioning Protocol — v0.1 (Draft for Comment) | spec (updated 11 June 2026; checked 29 October 2026): "A site or service publishes a single file at a well-known path: https://example.com/.well-known/agent-permissions.json 3.1 Minimal Example { "permissioning_version": "0.1", "owner": "example.com", "updated": "2026-06-11"" (https://permissioning.ai/spec/v0.1.html)
[^ref-41]: Ajar Protocol, Research: Prior Art and Positioning | Ajar Protocol (snapshot date July 2026; checked 29 October 2026): "A2A Agent Cards, MCP Server Cards (SEP-1649), NANDA AgentFacts, agent-permissions.json, robots.txt, sitemap.xml, llms.txt, UCP feeds — a site being "agent-ready" in 2026 means maintaining ~9 unsigned, uncoordinated files." (https://www.ajarprotocol.org/docs/protocol/research)
[^ref-42]: aibuddy Docs, Governance and Security (G) · aibuddy Docs — §9 of Agent Harness Engineering: A Survey (checked 29 October 2026): "Web-level permission coordination Site-declared action permissions and rate/confirmation requirements agent-permissions.json" (https://www.aibuddy.day/docs/en/etclovg/governance/)