Declared agent welcome

As agent traffic grows, what a government channel permits an agent to do (lodge a submission for a person, read and index it, train on its content) becomes a real policy question, and nowhere more than on a submissions channel, where the legitimate agent filing in the open is the alternative to the anonymous one filing covertly. Today the question is answered only by fragmented, unilateral signals descended from robots.txt. An agency that says nothing invites everything and then over-blocks at the edge with no record of the decision; an agency that blocks by default excludes the legitimate agents its own users depend on. Both are policy decisions no one is recorded as making, and increasingly not the agency's to make: a service behind a large CDN may already be emitting vendor-defined agent signals its policy owners never chose. Draft standards now exist for saying it explicitly, which puts the choice in front of agencies: declare what agent use is welcome, or keep making that policy by default and by vendor.

The IETF AIPREF working group. The IETF chartered AIPREF to standardize a vocabulary for expressing preferences about AI use of content and mechanisms to attach them via robots.txt and HTTP. The vocabulary draft is an adopted working-group document narrowed to two categories, train-ai and search, while its attachment companion has lapsed and the milestones have slipped a year. The charter is explicit that this expresses a preference without enforcing it: no access control, no authentication, no registries.

Cloudflare's Content Signals Policy. The policy layers three machine-readable yes-or-no signals, search, ai-input, and ai-train, onto robots.txt, running on more than 3.8 million domains through its managed robots.txt, on a count the operator publishes itself. The design consequence is not: an agency behind that infrastructure may already be signaling to agents without having decided to.

Really Simple Licensing. RSL attaches machine-readable licensing terms covering attribution and compensation to the same robots.txt-adjacent slots, with a collective-rights organization behind it. Government channels do not sell content. It still demonstrates that machine-readable conditions of agent use, and not only permissions, are viable.

llms.txt, the cautionary example from the same slot. The community proposal for an agent-facing index file has real tooling-side adoption and no documented crawler honoring it. A signal only one side of the conversation adopted binds nobody, which is why a declaration pairs with admission rather than replacing it.

The mechanics transfer today. An agency could publish content signals on its channels this afternoon, which is precisely why the gap is legible. None of the deployed or drafted vocabularies speaks to the interaction government cares about: whether an agent may lodge a submission here, for whom, and under what admission requirements. The categories are crawl-era (search, training, input), and the government-shaped extension is undesigned. The trust model does not transfer either. The web's version is a unilateral request aimed at strangers, while a government declaration would be read as a commitment. A commitment needs two things a request does not: parity between what is declared and what is enforced, and somewhere authoritative to publish it. Neither is designed yet, and the llms.txt experience sets the failure baseline for skipping them.