FREE CHEAT SHEET — AGENTGATE BY INGENIOUS AI

AI Agent Access Policy Cheat Sheet — ai governance, published where agents can read it

Reviewed October 25, 2026 — Ingenious AI security checks.

Direct answer: An AI agent access policy is a machine-readable declaration of which agents may use your site, what they may do, and on what commercial terms — published where agents look for it. This cheat sheet is for site owners doing AI governance on their own front door. AgentGate generates and validates the policy for you (Free generator and validator, Pro $49/mo, Team $149/mo), starting free at the standard location.

Key facts

One standard location: the policy lives at /.well-known/agent-policy.json, where agents and tools know to look.
3 declarations do the work: who may access, what they may do, and the commercial terms that apply.
A policy is only real if it validates: malformed JSON at the right URL is a locked door with no keyhole — agents skip it and guess.

What does an agent access policy declare about ai governance?

An agent access policy declares the rules of your site in a form machines can apply without a human reading a terms page: which identified agents are welcome, which actions they may take — read, summarise, transact — and the commercial terms attached to each, such as attribution, rate limits or paid tiers. It turns your AI governance from a paragraph nobody's agent reads into a file every agent can.

Who: named agents, classes of agents, or verified identities — allow, deny or conditional per identity.
What: the actions permitted per identity — browsing, indexing, summarising, quoting, purchasing, or none.
Terms: attribution requirements, rate limits, caching rules and commercial terms for use beyond the free grant.
Contact and precedence: where disputes go, and how this file relates to robots.txt and your human terms.

How do you publish and validate one?

Decide the defaults: what may an unlisted agent do? Deny-by-default and allow-by-default are both legitimate — ambiguity is not.
Generate the file from the decisions, in the standard schema, rather than hand-writing JSON.
Publish at /.well-known/agent-policy.json over HTTPS, served as JSON, with no login wall in front of it.
Validate the live file: syntax, schema and reachability — the copy on the server, not the draft on your disk.
Align robots.txt and terms so the three signals never contradict each other.
Review on a cadence: new agents and new business terms both make last quarter's policy stale.

Run the free check

The fastest way to apply this cheat sheet is the free check on AgentGate: its free generator drafts the policy and the validator checks the live file. Start on the AgentGate homepage, compare tiers on AgentGate pricing, and keep the full hosted reference open at the AI Agent Access Policy cheat sheet on AgentGate. Questions or orders: ask Ingenious AI on WhatsApp or email orders@getingeniousai.com.

Run the free check on AgentGate → Open the hosted cheat sheet →

More from Ingenious AI 21-PLATFORM SUITE

One vendor, one security posture. Every platform below is live now on getingeniousai.com.

Using BreachHunter? Pair it with DisclosureGuard for EU AI Act readiness — find the exposure, then prove compliance.

Using DisclosureGuard? Add TermsWatch — your AI vendors change their terms silently; we catch it.

Using ModelMinder? Pair it with TermsWatch — deprecation radar plus terms-change alerts on the same models.

Using Rogue-Agent Defense? Lock it down with Agent Auth Gateway (budget caps, allowlists, kill switch) and Agent Flight Recorder (hash-chained forensics).

Running agents in production? Agent Flight Recorder + Agent Auth Gateway give you the audit trail and the emergency brake.

Using ChatBreaker? Harden the human layer with DomainGuard — most social-engineering runs on lookalike domains.

Using DomainGuard? Sweep for what is already exposed with BreachHunter.

Shipping AI-built code? Vibe-Code Audit reviews it before attackers do — and Rogue-Agent Defense watches the agents that wrote it.

Publishing AI content? ContentCraft AI plus DisclosureGuard keeps every asset disclosed and compliant.

Explore the full Security Suite →

Frequently asked questions

What is an AI agent access policy?

It is a machine-readable file, published at /.well-known/agent-policy.json, that declares which AI agents may use your site, what actions each may take, and on what commercial terms. Unlike a human terms page, agents and tools can read and apply it automatically, which makes it an AI governance control rather than a statement of intent.

How is an agent policy different from robots.txt?

Robots.txt is a coarse, decades-old convention: mostly crawl permission per user-agent, with no actions, no commercial terms and no identity verification. An agent access policy is richer — per-agent permissions for specific actions like summarising or transacting, plus terms — and the two are designed to agree, with robots.txt handling classic crawling.

Where does the agent policy file live?

At the standard well-known location: https://your-domain/.well-known/agent-policy.json, served over HTTPS as JSON without authentication. The fixed location is the point — agents, validators and audit tools all look in exactly one place, the same way they do for security.txt and robots.txt.

What does AgentGate cost?

AgentGate's policy generator and validator are free. Pro is $49 per month for managed policies, change alerts and multiple sites, and Team is $149 per month. The free tools produce the complete standard file, so a single site can publish a valid policy today without paying anything.