The agent equivalent of terms & conditions

Authorize, don't accept.

Humans click “I agree” without reading. An AI agent should never do that. Instead, a domain publishes one JSON file that says exactly what an agent may do, its hard spending limits, when a human must approve, and what it must never accept — and a gate — the software your agent runs behind — enforces it so the agent can't, not just promises it won't.

In plain English. This page defines /.well-known/agent-policy — the policy file — and gives you two free tools: a validator that grades any domain's policy A–F, and a builder that writes yours. Our own file is the live reference: every line of it is backed by enforcement you can probe right now (hard spend caps at /api/caps, tested daily by a probe that tries to overspend and must be refused, every decision on a public audit chain).

What to do, in three steps:

Build your policy — declare scopes, caps, human-approval triggers, and what your agent must never accept.
Host it at https://yourdomain/.well-known/agent-policy (plain static JSON, https, no redirects).
Validate it — grade B or better means any gate, auditor, or counterparty can read exactly what your agent is allowed to do.

Grade a domain's agent policy

Reads only the public /.well-known/agent-policy (fixed path, https, no redirects) and, when declared, probes the same-domain enforcement-proof URL. Free — no API key or signup.

Domain

Build your agent policy

Answer four questions; this writes the file. Adjust anything before you host it — it is your policy.

Your domain Max spend per transaction (USDC, a digital dollar) — 0 = agent may not spend at all Max spend per day (USDC) Where should approvals and refusals be auditable? (https URL — your log, or leave ours as a placeholder)

The eight checks (normative)

#	Check	Why it matters
1	Policy file is reachable	Fixed path, HTTP 200 — gates and auditors look in exactly one place.
2	Valid JSON	Machines enforce this file; one syntax error and nothing is enforced.
3	Version declared	agentPolicyVersion: 1 tells enforcers which schema to expect.
4	Scopes declared	scopes.allow + a non-empty scopes.forbid — a policy with no forbidden actions authorizes nothing meaningful.
5	Spend rules	Numeric per-tx and per-day caps plus enforced_by (or an explicit "spend": "none"). Who enforces matters as much as the number.
6	Human-approval triggers	hitl.require_human (human-in-the-loop) — the conditions that must bring in a person, as data, not vibes.
7	Audit endpoint	An https URL where decisions can be independently re-checked.
8	Enforcement proof, live	The file is a claim; behavior is proof. If spend.proof names a same-domain URL, we fetch it and expect HTTP 200 — a live surface showing the limits actually enforced.

Canonical live example: ironbridge.foundation/.well-known/agent-policy — graded by the same validator as everyone else.

Where the ecosystem is

Honestly: as of 2026-08-26, no surveyed domain publishes an agent policy — agents everywhere either inherit human terms-of-service by accident or run unbounded. Grading F here is normal today. Publishing a policy costs one static file; enforcing it is your gate's job — ours is live and publicly tested daily, and the profile is open: adopt it without asking us. Pairs with the x402 Discovery Profile (how agents find and pay you) — discovery says what agents CAN buy; this says what your agent MAY do.

Honesty box: a policy file binds the agents whose gate enforces it — ours binds ours, provably. Publishing this file does not magically control third-party agents; it makes your rules machine-readable so gates, auditors, and counterparties can hold your agent to them. Draft v1, maintained by IronBridge; propose changes via contact.