agenticweb.wiki

agent-permissions.json

Last checked · 42 primary sources

This article is about the Lightweight Agent Standards Working Group (LAS-WG) advisory permission manifest for web agents at /.well-known/agent-permissions.json. For Wildcard AI's OpenAPI workflow bridge manifest at /.well-known/agents.json, see agents.json. For crawler-level allow and disallow directives in /robots.txt, see AI crawler tokens in robots.txt. For content-usage and training-preference signaling, see IETF AIPref Vocabulary and W3C TDM Reservation Protocol.

Overview

agent-permissions.json (titled Agent Permissions File in its JSON Schema) is an MIT-licensed, work-in-progress JSON manifest format proposed by the Lightweight Agent Standards Working Group (LAS-WG) through which websites declare advisory, machine-readable rules governing how browser-based AI agents interact with HTML elements, interpret natural-language behavioral norms, and discover structured API alternatives [1][2][6][8]. Published by default at /.well-known/agent-permissions.json or selected per page via an HTML <link rel="agent-permissions" href="..."> element, the manifest separates deterministic DOM-level interaction rules (resource_rules using CSS selectors, a closed vocabulary of interaction verbs, and rate/concurrency/oversight modifiers) from agent-level normative instructions (action_guidelines using RFC 2119 directives) and structured service pointers (api advertising OpenAPI, Model Context Protocol, or Agent-to-Agent endpoints) [2][8].

Rationale and architectural positioning

Modern browser-based AI agents interact with web applications by clicking controls, filling and submitting forms, scrolling viewports, controlling media playback, and executing multi-step UI workflows rather than merely fetching static documents for indexing [2][8]. In las-wg/agent-permissions.json, LAS-WG frames the specification as A robots.txt-inspired standard for how agents may interact with webpages. and explains its scope in the specification introduction [2]:

"Websites need a machine-readable, non-binding way to declare how automated agents (bots, crawlers, assistants) may interact with them. This JSON-only Agent Permissions File lets sites express fine-grained resource-level rules and higher-level action guidelines in a single, versioned document." [2]

Both the specification and the companion paper Permission Manifests for Web Agents (arXiv:2601.02371) distinguish UI-interaction governance from adjacent web standards [2][8]:

The manifest is explicitly a voluntary coordination layer rather than an cryptographic access-control boundary [2][8]:

"This file is advisory and non-binding: agents MAY choose stricter behaviors than those granted here, but MUST NOT exceed the permissions granted if they claim to honor this format." [2]

In Section 4.1 of the paper, the authors argue that decoupling declarative permissions from site-side enforcement (such as rate shaping, WAF rules, or attestation) establishes an explicit baseline against which enforcement systems can evaluate traffic [8]:

"In other words, the question for the enforcement system shifts from "is the agent operating with a malicious intent?" to "is the agent following the rules in agent-permissions.json?"" [8]

Discovery and resolution order

The specification defines two discovery mechanisms — a page-level HTML <link> element and a root well-known URI fallback [2][8]:

"Consumers MAY locate and fetch the JSON policy via a link tag, e.g.: <link rel="agent-permissions" href="https://example.com/path/to/agent-permissions.json"> In case of no <link> tag, the default path is /.well-known/agent-permissions.json. Servers SHOULD serve this file with Content-Type: application/json." [2]

In Section 3.1 of Permission Manifests for Web Agents, the authors state that the <link rel="agent-permissions" href="https://…"> tag overrides the root /.well-known/agent-permissions.json file so site operators can attach custom rules to a specific page while retaining the root manifest as the site-wide default [8]. Neither the specification nor the reference Python library defines a rule-merging or inheritance algorithm between a page-linked manifest and the root well-known manifest: in las-wg/agent-permissions-python (src/agent_permissions/__init__.py and src/agent_permissions/io/resolvers.py), discover_manifest() checks <link rel="agent-permissions"> first (method="html_link_tag") and queries /.well-known/agent-permissions.json (method="default_well_known") only if no link-referenced manifest is found or if loading the link target raises an AgentPermissionsError [21][23].

Top-level JSON Schema structure and the strict schema divergence

The specification README.md embeds a Draft-07 JSON Schema ("$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "strict"]) whose root object sets "additionalProperties": false and defines five top-level properties [2]:

  1. metadata (required object, additionalProperties: false): Requires schema_version (type: "string", matching regex ^\d+\.\d+\.\d+$) and last_updated (type: "string", format: "date-time"), and accepts optional author (type: "string") [2].
  2. strict (required boolean in README.md): Prescribes the fallback policy for any interaction not matched by an explicit rule: The top-level field strict prescribes the default behavior for an action that is not explicitly allowed or forbidden (true: defaults to forbidden, false: defaults to allowed). [2].
  3. resource_rules (optional array): Ordered list of element-level interaction rules, each requiring verb, selector, and allowed, with optional modifiers and additionalProperties: false [2].
  4. action_guidelines (optional array): List of natural-language behavioral rules, each requiring directive and description, with optional exceptions and additionalProperties: false [2].
  5. api (optional array): List of structured endpoint descriptors, each requiring type, endpoint, and description, with optional docs and additionalProperties: false [2].

Inspection of the LAS-WG repositories and paper reveals an important schema synchronization discrepancy across the project's own artifacts [2][4][8][20][24][25][35]:

resource_rules: selectors, verbs, modifiers, and CSS specificity priority

The specification separates element-level rules from workflow-level guidelines [2][8]:

"There are two forms of permissions: Resource permissions: how you can interact with HTML elements (clicking, following links, filling forms, controlling media, uploading files…). Action permissions: what you can do on the web page (sending DMs, booking a flight, posting content…)." [2]

In Section 3.2 of the paper, the authors cite authenticated-delegation research to motivate this split: A core design principle of the manifest is that automated interactions operate along two complementary dimensions: interactions with specific resources and general actions (South et al., 2025). [8]. Each item in resource_rules pairs a CSS selector string (XPath selectors were removed on 4 December 2025 in commit 939b6431, "date": "2025-12-04T01:18:49Z" }, "message": "Dropped XPath support.") with a boolean allowed flag and a verb from a closed enumeration [2][4]:

"The verb in each resource_rules entry MUST be one of the following values. Future versions MAY extend this list; unknown verbs MUST be treated as disallowed." [2]

The permitted verb values in the specification schema are all (wildcard for all verbs), read_content (human-visible body text, headings, and labels), read_metadata (<title>, <meta>, OpenGraph, JSON-LD), follow_link (activating <a> elements to navigate), click_element (synthesizing a click on buttons, links, or controls), scroll_page, set_input_value (setting text/number inputs, checkboxes, radio buttons, or dropdowns), submit_form (submitting the enclosing <form>), execute_script (executing JavaScript in page context), play_media, pause_media, mute_media, unmute_media, upload_file (attaching files to <input type="file">), download_file, and copy_to_clipboard [2]. Higher-level UI workflows are modeled as sequences of primitive verbs: Some higher-level behaviors (for example, "fill this form") are expected to be composite operations built from primitive verbs (e.g. multiple set_input_value calls followed by submit_form). [2].

Each resource rule may include a modifiers object (additionalProperties: false) with up to four optional constraints [2]:

When multiple resource_rules match a target DOM element, the specification prescribes two priority rules [2]:

"Apply resource_rules following priority rules: Specific verbs have higher priority over all For the same verb, follow CSS priority rules" [2]

In the reference implementation (src/agent_permissions/validation/interaction_validator.py), _find_matching_rule() partitions matching selectors into verb_specific_rules (exact verb match) and wildcard_rules (verb == "all"), selects verb_specific_rules if non-empty, computes each selector's CSS specificity tuple via SpecificityCalculator.calculate(selector), and breaks equal-specificity ties by selecting the rule that appears later in the resource_rules array (# CSS specificity: higher tuple wins; if equal, later rules override. chosen_bucket.sort(key=lambda item: (item[1].to_list(), item[2])) return chosen_bucket[-1][0]) [26].

action_guidelines, api references, and enforcement boundaries

For norms that cannot be reduced to individual DOM elements, action_guidelines entries combine an RFC 2119 directive ("MUST", "MUST NOT", "SHOULD", or "SHOULD NOT") with a natural-language description and optional exceptions string [2][8]. The specification maps violations to logging severities (MUST NOT → error log, SHOULD NOT → warning, SHOULD → info) and assigns resource_rules and action_guidelines to separate architectural layers [2]:

"We expect the implementation of resource_rules to happen at the browser interface level (e.g. the agent is blocked from performing unintended interactions) and the implementation of action_guidelines to happen at the agent level (e.g. by feeding these rules to the LLM or equivalent decision component)." [2]

Because action_guidelines are injected into an LLM's context window (via build_prompt_instructions() in src/agent_permissions/prompt/builder.py), Section 4.2 of the paper explicitly warns against prompt injection through malicious manifests [8][27]:

"Since action guidelines are expressed in natural language, a malicious or adversarial site could attempt to use them as a channel for prompt injection or manipulation of agent behavior. Frameworks should therefore treat manifest content as untrusted input" [8]

The optional api array allows publishers to advertise structured endpoints alongside DOM rules (Finally, the field api provides information on what actions can be performed by calling HTTP APIs (e.g. REST) instead of interacting with the website, as the former is often more efficient and reliable than the latter.), supporting type values of "openapi", "mcp", and "a2a" (agent-permissions.json provides native support for advertising MCP and A2A endpoints alongside OpenAPI specifications (see Section 3.5).) [2][8]. As Section 3.5 of the paper states: The manifest therefore treats APIs as the "happy path" but not the sole path. Agents are encouraged to use APIs when possible, but may fall back to DOM-level interactions when necessary. [8]. Notably, while the specification schema types endpoint and docs as plain strings and illustrates "endpoint": "mcp://example/agents" in Figure 2(c) of the paper, the Pydantic model in las-wg/agent-permissions-python (src/agent_permissions/models/manifest.py) declares class APIReference(BaseModel): model_config = ConfigDict(extra="forbid") type: str = Field(pattern=r"^(openapi|mcp|a2a)$") endpoint: HttpUrl description: str docs: Optional[HttpUrl] = None, which rejects mcp:// URIs under Pydantic HttpUrl validation [2][8][25]. On any schema or model validation failure, the specification mandates fail-closed fallback to the agent's baseline safety policy [2]:

"Parse according to the schema; on validation failure, consumers SHOULD treat the file as absent and MUST NOT grant additional permissions based on it (i.e., disallow all interactions beyond their default safety policies)." [2]

Who uses it

Who reads it

Reference Python library (las-wg/agent-permissions-python v0.1.0)

Headless browser and agent-framework integration samples (Playwright, Selenium, BrowserUse)

Policy generator & parser playground (las-wg/agent-permissions-generator)

Recent coverage

See also

References

  1. Lightweight Agent Standards Working Group (LAS-WG), GitHub - las-wg/agent-permissions.json: robots.txt-style permission manifest for web agents (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): "robots.txt-style permission manifest for web agents" — https://github.com/las-wg/agent-permissions.json
  2. Lightweight Agent Standards Working Group (LAS-WG), README.md — `agent-permissions.json` specification in `las-wg/agent-permissions.json` (commit `44ce979a`, 10 December 2025; checked 29 October 2026): "A robots.txt-inspired standard for how agents may interact with webpages." "Note: This standard is still WIP!" "Websites need a machine-readable, non-binding way to declare how automated agents (bots, crawlers, assistants) may interact with them. This JSON-only Agent Permissions File lets sites express fine-grained resource-level rules and higher-level action guidelines in a single, versioned document." "This document does not cover agent-to-agent interactions or content usage policies (see IETF AIPref instead)." "This file is advisory and non-binding: agents MAY choose stricter behaviors than those granted here, but MUST NOT exceed the permissions granted if they claim to honor this format." "Consumers MAY locate and fetch the JSON policy via a link tag, e.g.:" "In case of no <link> tag, the default path is /.well-known/agent-permissions.json. Servers SHOULD serve this file with Content-Type: application/json." "There are two forms of permissions: Resource permissions: how you can interact with HTML elements (clicking, following links, filling forms, controlling media, uploading files…). Action permissions: what you can do on the web page (sending DMs, booking a flight, posting content…)." "The top-level field strict prescribes the default behavior for an action that is not explicitly allowed or forbidden (true: defaults to forbidden, false: defaults to allowed)." "Implementation-wise, agents can follow resource_rules at the interface level (e.g. if the agent is using a headless browser to perform an action, the code connecting the agent to the browser can act as an enforcement layer), while action_guidelines are provided as prompt or configuration to the agent." "Some higher-level behaviors (for example, "fill this form") are expected to be composite operations built from primitive verbs (e.g. multiple set_input_value calls followed by submit_form)." "Finally, the field api provides information on what actions can be performed by calling HTTP APIs (e.g. REST) instead of interacting with the website, as the former is often more efficient and reliable than the latter." "The verb in each resource_rules entry MUST be one of the following values. Future versions MAY extend this list; unknown verbs MUST be treated as disallowed." ""$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "strict"]" "Parse according to the schema; on validation failure, consumers SHOULD treat the file as absent and MUST NOT grant additional permissions based on it (i.e., disallow all interactions beyond their default safety policies)." "Apply resource_rules following priority rules: 1. Specific verbs have higher priority over all 2. For the same verb, follow CSS priority rules" "We expect the implementation of resource_rules to happen at the browser interface level (e.g. the agent is blocked from performing unintended interactions) and the implementation of action_guidelines to happen at the agent level (e.g. by feeding these rules to the LLM or equivalent decision component)." — https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/README.md
  3. GitHub REST API, las-wg/agent-permissions.json repository metadata (created 5 August 2025; last pushed 10 December 2025; checked 29 October 2026): ""created_at": "2025-08-05T23:47:17Z", "updated_at": "2026-06-22T15:31:01Z", "pushed_at": "2025-12-10T22:53:58Z"" — https://api.github.com/repos/las-wg/agent-permissions.json
  4. GitHub REST API, las-wg/agent-permissions.json commit history (5 August 2025 – 10 December 2025; checked 29 October 2026): ""date": "2025-12-10T22:53:58Z" }, "message": "Add 'strict' field to agent permissions schema" "Added a 'strict' field to define default action behavior."" ""date": "2025-12-04T01:18:49Z" }, "message": "Dropped XPath support."" ""date": "2025-11-27T23:04:01Z" }, "message": "Update to v0.3 draft."" ""date": "2025-08-05T23:47:17Z" }, "message": "Initial commit"" — https://api.github.com/repos/las-wg/agent-permissions.json/commits?per_page=100
  5. GitHub REST API, samuelemarro contributor statistics on `las-wg/agent-permissions.json` (checked 29 October 2026): ""login": "samuelemarro", "id": 13946873, "node_id": "MDQ6VXNlcjEzOTQ2ODcz", "avatar_url": "https://avatars.githubusercontent.com/u/13946873?v=4", "gravatar_id": "", "url": "https://api.github.com/users/samuelemarro", "html_url": "https://github.com/samuelemarro", "followers_url": "https://api.github.com/users/samuelemarro/followers", "following_url": "https://api.github.com/users/samuelemarro/following{/other_user}", "gists_url": "https://api.github.com/users/samuelemarro/gists{/gist_id}", "starred_url": "https://api.github.com/users/samuelemarro/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/samuelemarro/subscriptions", "organizations_url": "https://api.github.com/users/samuelemarro/orgs", "repos_url": "https://api.github.com/users/samuelemarro/repos", "events_url": "https://api.github.com/users/samuelemarro/events{/privacy}", "received_events_url": "https://api.github.com/users/samuelemarro/received_events", "type": "User", "user_view_type": "public", "site_admin": false, "contributions": 9" — https://api.github.com/repos/las-wg/agent-permissions.json/contributors
  6. Lightweight Agent Standards Working Group (LAS-WG), LICENSE (MIT License) in `las-wg/agent-permissions.json` (6 August 2025; checked 29 October 2026): "MIT License Copyright (c) 2025 Lightweight Agent Standard Working Group (LAS-WG)" — https://raw.githubusercontent.com/las-wg/agent-permissions.json/main/LICENSE
  7. Samuele Marro et al. (Lightweight Agent Standards Working Group), [2601.02371] Permission Manifests for Web Agents, arXiv abstract and submission history (v1 submitted 7 December 2025; v2 revised 12 January 2026; checked 29 October 2026): "[v1] Sun, 7 Dec 2025 17:45:01 UTC (207 KB) [v2] Mon, 12 Jan 2026 23:23:48 UTC (208 KB)" "Subjects: Computers and Society (cs.CY); Artificial Intelligence (cs.AI); Multiagent Systems (cs.MA); Networking and Internet Architecture (cs.NI)" — https://arxiv.org/abs/2601.02371
  8. Samuele Marro, Alan Chan, Xinxing Ren, Lewis Hammond, Jesse Wright, Gurjyot Wanga, Tiziano Piccardi, Nuno Campos, Tobin South, Jialin Yu, Sunando Sengupta, Eric Sommerlade, Alex Pentland, Philip Torr, and Jiaxin Pei (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, `arXiv:2601.02371v2` HTML edition (12 January 2026; manuscript dated August 2025; checked 29 October 2026): "arXiv:2601.02371v2 [cs.CY] 12 Jan 2026 Permission Manifests for Web Agents Lightweight Agent Standards Working Group (LAS-WG)" "Tobin South Jialin Yu Sunando Sengupta Eric Sommerlade Alex Pentland Philip Torr Jiaxin Pei Affiliation: Stanford University Microsoft UT Austin August 2025" "We introduce agent-permissions.json, a robots.txt -style lightweight manifest where websites specify allowed interactions, complemented by API references where available." "llms.txt helps agents read a site efficiently, but not interact with it responsibly." "We therefore treat AIPref and TDMRep as an adjacent layer in a broader stack: content-use signals govern what models may do with data, while our permission manifest governs how agents may behave on pages." "Compared to Pay per Crawl, agent-permissions.json addresses a different problem: specifying permissible interactions rather than monetizing access." "agent-permissions.json provides native support for advertising MCP and A2A endpoints alongside OpenAPI specifications (see Section 3.5)." "The file contains four top-level fields: • metadata (mandatory): basic information including schema version, last update timestamp, and document author; • resource_rules (mandatory): rules governing how agents may interact with HTML elements (Section 3.3)." "A core design principle of the manifest is that automated interactions operate along two complementary dimensions: interactions with specific resources and general actions (South et al., 2025)." "The manifest therefore treats APIs as the "happy path" but not the sole path. Agents are encouraged to use APIs when possible, but may fall back to DOM-level interactions when necessary." "In other words, the question for the enforcement system shifts from "is the agent operating with a malicious intent?" to "is the agent following the rules in agent-permissions.json?"" "Since action guidelines are expressed in natural language, a malicious or adversarial site could attempt to use them as a channel for prompt injection or manipulation of agent behavior. Frameworks should therefore treat manifest content as untrusted input" "Since most agents rely on headless browser automation (e.g., Selenium, Playwright, and Puppeteer) to interact with websites, we can apply resource rules at the browser interface layer. The mechanism is simple: when the agent attempts an interaction, the driver checks the manifest before issuing the corresponding DOM command. If the action is disallowed, the attempt is blocked." "Samuele Marro is supported by the EPSRC Centre for Doctoral Training in Autonomous Intelligent Machines and Systems n. EP/Y035070/1, in addition to Microsoft Ltd." — https://arxiv.org/html/2601.02371v2
  9. Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents, `arXiv:2601.02371v1` HTML edition (7 December 2025; checked 29 October 2026): "Tobin South Jialin Yu Alex Pentland Philip Torr Jiaxin Pei Affiliation: Anthropic Stanford University UT Austin August 2025" — https://arxiv.org/html/2601.02371v1
  10. Samuele Marro et al. (Lightweight Agent Standards Working Group), Permission Manifests for Web Agents (`arXiv:2601.02371v2` PDF edition — author list and typeset superscripts `Samuele Marro1,2∗, Alan Chan3, Xinxing Ren4, Lewis Hammond1,5, Jesse Wright1,2, Gurjyot Wanga6, Tiziano Piccardi7, Nuno Campos8, Tobin South9,2, Jialin Yu1,2, Sunando Sengupta10, Eric Sommerlade10, Alex Pentland9, Philip Torr1,2, Jiaxin Pei11,9,2`, 12 January 2026; checked 29 October 2026): "Samuele Marro; Alan Chan; Xinxing Ren; Lewis Hammond; Jesse Wright; Gurjyot Wanga; Tiziano Piccardi; Nuno Campos; Tobin South; Jialin Yu; Sunando Sengupta; Eric Sommerlade; Alex Pentland; Philip Torr; Jiaxin Pei" — https://arxiv.org/pdf/2601.02371v2
  11. Lightweight Agent Standards Working Group, LAS-WG | Lightweight Agent Standard Working Group official website (checked 29 October 2026): "LAS-WG develops interoperable standards for agent communication avoiding bloated protocols in favor of quick, iterative testing." — https://las-wg.org/
  12. GitHub REST API, las-wg/agent-permissions.json in `orgs/las-wg/repos` organization repository inventory (5 March 2025 – 15 January 2026; checked 29 October 2026): ""full_name": "las-wg/agent-permissions.json", "private": false, "owner": { "login": "las-wg", "id": 202027760, "node_id": "O_kgDODAqy8A", "avatar_url": "https://avatars.githubusercontent.com/u/202027760?v=4", "gravatar_id": "", "url": "https://api.github.com/users/las-wg", "html_url": "https://github.com/las-wg", "followers_url": "https://api.github.com/users/las-wg/followers", "following_url": "https://api.github.com/users/las-wg/following{/other_user}", "gists_url": "https://api.github.com/users/las-wg/gists{/gist_id}", "starred_url": "https://api.github.com/users/las-wg/starred{/owner}{/repo}", "subscriptions_url": "https://api.github.com/users/las-wg/subscriptions", "organizations_url": "https://api.github.com/users/las-wg/orgs", "repos_url": "https://api.github.com/users/las-wg/repos", "events_url": "https://api.github.com/users/las-wg/events{/privacy}", "received_events_url": "https://api.github.com/users/las-wg/received_events", "type": "Organization", "user_view_type": "public", "site_admin": false }, "html_url": "https://github.com/las-wg/agent-permissions.json", "description": "robots.txt-style permission manifest for web agents"" — https://api.github.com/orgs/las-wg/repos
  13. Lightweight Agent Standards Working Group, README.md in `las-wg/info` (checked 29 October 2026): "LAS-WG develops interoperable standards for agent communication. We address concrete, immediate challenges by defining clear, focused guidelines that enhance consistency across the industry." — https://raw.githubusercontent.com/las-wg/info/master/README.md
  14. Lightweight Agent Standards Working Group, charter.md — Lightweight Agent Standard Working Group (LAS-WG) Charter in `las-wg/info` (checked 29 October 2026): "The LAS-WG focuses exclusively on the standardization of specific, clearly defined problems within agent-to-agent communication, agent operation, and agent-to-world communication." "Votes are decided by simple relative majority, typically lasting one week unless a longer period is specified by the Chair. All voting processes are public, with each member organization holding exactly one vote cast by their designated representative." "All LAS-WG outputs and standards shall be licensed under Creative Commons BY 4.0 or an equivalently permissive license." — https://raw.githubusercontent.com/las-wg/info/master/charter.md
  15. Lightweight Agent Standards Working Group, voting-members.md in `las-wg/info` (checked 29 October 2026): "The following organizations have voting rights: - AgentOps - Agora Protocol - Agent Network Protocol - Camel AI - Centre for the Governance of AI - Cosmos Institute - LangChain - Massachusetts Institute of Technology - Stanford University - University of Oxford - Wildcard" — https://raw.githubusercontent.com/las-wg/info/master/voting-members.md
  16. Samuele Marro, cv | Samuele Marro — academic curriculum vitae (March 2025 – present; checked 29 October 2026): "Mar 2025 - Present Chair Lightweight Agent Standards Working Group Industry-academia joint working group, focused on designing and iterating quickly on standards for agent interactions. Notable organizations: Oxford University, Stanford University, MIT, Firecrawl." — https://samuelemarro.it/cv/
  17. Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-python: Python library to retrieve and parse agent-permissions.json (created 15 October 2025; last pushed 10 December 2025; checked 29 October 2026): "Python library to retrieve and parse agent-permissions.json" — https://github.com/las-wg/agent-permissions-python
  18. Lightweight Agent Standards Working Group, README.md in `las-wg/agent-permissions-python` (13 October 2025; checked 29 October 2026): "This package provides utilities for discovering, fetching, validating, and enforcing agent-permissions.json manifest files exposed by websites. It is designed to plug into agentic frameworks that need to respect site-defined automation policies." "For more detailed documentation, consult design/library.md." — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/README.md
  19. Lightweight Agent Standards Working Group, pyproject.toml (`agent-permissions` v0.1.0) in `las-wg/agent-permissions-python` (11 October 2025; checked 29 October 2026): "name = "agent-permissions" version = "0.1.0" description = "Python tools for discovering, parsing, and enforcing agent-permissions manifests on the web."" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/pyproject.toml
  20. GitHub REST API, las-wg/agent-permissions-python commit history (26 September 2025 – 10 December 2025; checked 29 October 2026): ""date": "2025-12-10T12:45:33Z" }, "message": "Harmonized with release version of schema."" ""date": "2025-12-10T14:43:43Z" }, "message": "Simplified interaction checking."" — https://api.github.com/repos/las-wg/agent-permissions-python/commits?per_page=100
  21. Lightweight Agent Standards Working Group, __init__.py in `las-wg/agent-permissions-python/src/agent_permissions/` (checked 29 October 2026): "__all__ = [ "fetch_manifest", "discover_manifest", "parse_manifest_from_html", "validate_interaction", "ensure_interaction_allowed", "build_prompt_instructions", "Manifest", "ValidationResult", ]" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/__init__.py
  22. Lightweight Agent Standards Working Group, config.py in `las-wg/agent-permissions-python/src/agent_permissions/` (checked 29 October 2026): "http_timeout: float = 10.0 http_user_agent: str = ("agent-permissions-python/0.1 (+https://example.com/agent-permissions)") enable_cache: bool = True cache_ttl_seconds: int = 900" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/config.py
  23. Lightweight Agent Standards Working Group, discovery.py in `las-wg/agent-permissions-python/src/agent_permissions/io/` (checked 29 October 2026): "LINK_REL = "agent-permissions" DEFAULT_WELL_KNOWN_PATH = "/.well-known/agent-permissions.json"" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/io/discovery.py
  24. Lightweight Agent Standards Working Group, agent-permissions.schema.json bundled JSON Schema in `las-wg/agent-permissions-python` (10 December 2025; checked 29 October 2026): ""$schema": "http://json-schema.org/draft-07/schema#", "title": "Agent Permissions File", "type": "object", "required": ["metadata", "resource_rules"]" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/data/agent-permissions.schema.json
  25. Lightweight Agent Standards Working Group, manifest.py Pydantic models in `las-wg/agent-permissions-python/src/agent_permissions/models/` (10 December 2025; checked 29 October 2026): "class APIReference(BaseModel): model_config = ConfigDict(extra="forbid") type: str = Field(pattern=r"^(openapi|mcp|a2a)$") endpoint: HttpUrl description: str docs: Optional[HttpUrl] = None" "class Manifest(BaseModel): model_config = ConfigDict(extra="forbid") metadata: ManifestMetadata resource_rules: List[ResourceRule] action_guidelines: List[ActionGuideline] = Field(default_factory=list) api: List[APIReference] = Field(default_factory=list)" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/models/manifest.py
  26. Lightweight Agent Standards Working Group, interaction_validator.py in `las-wg/agent-permissions-python/src/agent_permissions/validation/` (10 December 2025; checked 29 October 2026): "if matching_rule is None: return ValidationResult(allowed=False, matched_rule=None, reasons=["No matching resource rule"],)" "# CSS specificity: higher tuple wins; if equal, later rules override. chosen_bucket.sort(key=lambda item: (item[1].to_list(), item[2])) return chosen_bucket[-1][0]" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/validation/interaction_validator.py
  27. Lightweight Agent Standards Working Group, builder.py in `las-wg/agent-permissions-python/src/agent_permissions/prompt/` (checked 29 October 2026): "lines.append(f"Respect the site's agent permissions (schema {meta.schema_version}, last updated {meta.last_updated.isoformat()}).")" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/src/agent_permissions/prompt/builder.py
  28. Lightweight Agent Standards Working Group, agent-permissions.json (`DemoCo` sample manifest, timestamped `2025-06-01T12:00:00Z`) in `las-wg/agent-permissions-python/samples/` (checked 29 October 2026): ""metadata": { "schema_version": "1.0.0", "last_updated": "2025-06-01T12:00:00Z", "author": "DemoCo" }" — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/agent-permissions.json
  29. Lightweight Agent Standards Working Group, playwright_integration.py in `las-wg/agent-permissions-python/samples/` (checked 29 October 2026): "Async example integrating agent-permissions with Playwright." — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/playwright_integration.py
  30. Lightweight Agent Standards Working Group, selenium_integration.py in `las-wg/agent-permissions-python/samples/` (checked 29 October 2026): "Example workflow integrating agent-permissions with Selenium." — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/selenium_integration.py
  31. Lightweight Agent Standards Working Group, browseruse_integration.py in `las-wg/agent-permissions-python/samples/` (checked 29 October 2026): "Illustrative example of integrating agent-permissions with BrowserUse." — https://raw.githubusercontent.com/las-wg/agent-permissions-python/main/samples/browseruse_integration.py
  32. Lightweight Agent Standards Working Group, GitHub - las-wg/agent-permissions-generator: Website to generate agent-permissions.json given a URL. (created 15 October 2025; last pushed 7 January 2026; checked 29 October 2026): "Website to generate agent-permissions.json given a URL." — https://github.com/las-wg/agent-permissions-generator
  33. Lightweight Agent Standards Working Group, README.md (Agent Permissions Playground) in `las-wg/agent-permissions-generator` (7 January 2026; checked 29 October 2026): "A small Next.js app for drafting, testing, and explaining agent-permissions.json files. You can try it live at https://agent-permissions-tools.vercel.app/." "Retrieval is single-page only; links are not crawled. Robots.txt is respected when present." — https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/README.md
  34. GitHub REST API, las-wg/agent-permissions-generator commit history (1 October 2025 – 7 January 2026; checked 29 October 2026): ""date": "2026-01-07T16:06:54Z" }, "message": "README and minor fixes."" — https://api.github.com/repos/las-wg/agent-permissions-generator/commits?per_page=100
  35. Lightweight Agent Standards Working Group, page.tsx in `las-wg/agent-permissions-generator/src/app/` (checked 29 October 2026): "const policy = { metadata: { schema_version: "1.0.0", last_updated: now," — https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/page.tsx
  36. Lightweight Agent Standards Working Group, crawl.ts in `las-wg/agent-permissions-generator/src/lib/` (checked 29 October 2026): "reason: "Fetched landing page (single-page snapshot; links not followed)"" — https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/lib/crawl.ts
  37. Lightweight Agent Standards Working Group, route.ts in `las-wg/agent-permissions-generator/src/app/api/generate/` (checked 29 October 2026): "const STANDARD_PATH = path.join(process.cwd(), "design", "standard.md");" "if (!standardContent) { notes.push("Unable to load local agent-permissions standard; proceeding without it."); }" "const model = "gpt-5-mini";" — https://raw.githubusercontent.com/las-wg/agent-permissions-generator/main/src/app/api/generate/route.ts
  38. Lightweight Agent Standards Working Group, Agent Permissions Generator live web deployment (checked 29 October 2026): "Agent Permissions Generator" — https://agent-permissions-tools.vercel.app/
  39. SciRate, Permission Manifests for Web Agents bibliographic record for `arXiv:2601.02371` (submitted 7 December 2025; published 7 January 2026; updated 12 January 2026; checked 29 October 2026): "Submitted 07 Dec 2025 to Computers and Society [cs.CY] Published 07 Jan 2026 Updated 12 Jan 2026" — https://scirate.com/arxiv/2601.02371
  40. Uljan Sinani, The Permissioning Protocol — v0.1 (Draft for Comment) | spec (updated 11 June 2026; checked 29 October 2026): "A site or service publishes a single file at a well-known path: https://example.com/.well-known/agent-permissions.json 3.1 Minimal Example { "permissioning_version": "0.1", "owner": "example.com", "updated": "2026-06-11"" — https://permissioning.ai/spec/v0.1.html
  41. Ajar Protocol, Research: Prior Art and Positioning | Ajar Protocol (snapshot date July 2026; checked 29 October 2026): "A2A Agent Cards, MCP Server Cards (SEP-1649), NANDA AgentFacts, agent-permissions.json, robots.txt, sitemap.xml, llms.txt, UCP feeds — a site being "agent-ready" in 2026 means maintaining ~9 unsigned, uncoordinated files." — https://www.ajarprotocol.org/docs/protocol/research
  42. aibuddy Docs, Governance and Security (G) · aibuddy Docs — §9 of Agent Harness Engineering: A Survey (checked 29 October 2026): "Web-level permission coordination Site-declared action permissions and rate/confirmation requirements agent-permissions.json" — https://www.aibuddy.day/docs/en/etclovg/governance/

JSON · Markdown · OKF v0.2