Agent Policy v0.2 (draft)

A small, open format a business publishes so AI agents know how to reach it. Personal agents now phone, book and request quotes from businesses that were never designed to receive them, and the business has no standard way to set terms. Agent Policy is that way: one JSON file, like robots.txt but for commerce.

Anyone may publish it, implement it or extend it, with or without snuepi. snuepi generates and signs it from the rules a business already set, but the format belongs to nobody.

Where it lives

https://<the business's domain>/.well-known/agent-policy.json (the file itself, or a redirect to it), and/or
a link in the business's web pages: <link rel="agent-policy" href="…/agent-policy.json">

An agent about to contact a business should look for the policy first and follow it. If none exists, the agent should behave as if ai_must_identify is true and unsolicited outreach is not accepted.

Fields

Field	Meaning
`agent_policy`	Format version, e.g. `"0.2"`.
`business`	`name`, `organization_number`, `country`, `page`.
`identification`	`ai_must_identify` (the agent says it is an AI, in calls and messages), `agent_name_required`, `on_behalf_of_required` (who the agent acts for), `signed_requests` (whether HTTP Message Signatures are preferred), `accepted_proofs_of_principal` (how the business verifies whom the agent acts for, e.g. `customer_email_confirmation`, `http_message_signatures`, `business_registry_domain_match`), `recording_of_staff` (`not_allowed` or `only_with_consent_asked_at_start`; a transcript counts as a recording).
`contact`	`agents_may_contact`: `yes`, `channels_only` or `no`. `phone_calls_from_agents`: `accepted`, `accepted_in_hours` (with `phone_hours`) or `not_accepted`. `quiet_hours` (no contact at all), `max_contacts_per_agent_per_day` (no redialling). `preferred` channel, and the channels: `mcp`, `rest`, `booking_page`, `email`. Agents should use these instead of phoning when phone is not accepted.
`booking`	`instant_booking`, `who_can_book_directly` (`anyone`, `customer_confirms_by_email`, `verified_businesses_only`, `nobody_owner_approves_all`), `max_amount_without_owner_ex_vat`, `currency`, `lead_time_hours`, `working_days` (1 = Monday), `working_hours`, `timezone`, `max_agent_bookings_per_day`, `cancellation_deadline_hours`, `must_provide` (what the agent must collect from its principal before booking: `address`, `photos`, `access_instructions`, `pets`, `allergies`, `party_size`, `parking`), `deposit` (percent or amount, paid to the business at booking), `no_show_fee_percent`, `one_booking_per_customer`, `resale` (`not_allowed`).
`quotes`	`price_source` (where a binding price comes from; agents should not quote from memory or a stale profile) and `site_visit`: `required` (`never`, `larger_jobs`, `always`), whether it is `bookable`, its price and where to book it. Many trades cannot price a job by phone; this tells the agent to book the visit instead.
`negotiation`	`allowed`, `max_negotiations_per_sender_per_day`, what happens `beyond_limit` (e.g. `list_price_only`), and a link to a signed `mandate` if the business has authorised agents to agree terms.
`rate_limit`	`requests_per_minute` an agent may send.
`outreach`	`unsolicited_sales_or_marketing` and `data_collection_for_training`: `accepted` or `not_accepted`.
`consumers`	Consumer-law facts an agent acting for a private person must respect, e.g. `withdrawal_period_days` and `early_start_needs_explicit_consent`.
`standards`	Related standards the business also serves, e.g. the Personal Agent Protocol once published.
`updated_at`	Date the policy last changed.
`signature`	Optional. A JWS over the policy, so an agent can check it was issued for this business and not altered. snuepi's keys are at /.well-known/snuepi-keys.json.

Example

{
  "agent_policy": "0.2",
  "business": { "name": "Kontorbedarf Becker GmbH", "organization_number": "DE123456789", "country": "DE" },
  "identification": { "ai_must_identify": true, "agent_name_required": true, "on_behalf_of_required": true,
                      "signed_requests": "preferred (HTTP Message Signatures / Web Bot Auth)",
                      "accepted_proofs_of_principal": ["customer_mandate_oauth", "customer_email_confirmation",
                        "http_message_signatures", "business_registry_domain_match", "snuepi_buyer_key"],
                      "recording_of_staff": "not_allowed" },
  "contact": {
    "agents_may_contact": "channels_only",
    "phone_calls_from_agents": "not_accepted",
    "quiet_hours": { "from": "20:00", "to": "07:00" },
    "max_contacts_per_agent_per_day": 3,
    "preferred": "mcp",
    "mcp": "https://snuepi.com/api/directory/mcp",
    "acp": { "checkout": "https://snuepi.com/api/acp/kontorbedarf-becker/checkout_sessions",
             "product_feed": "https://snuepi.com/api/acp/kontorbedarf-becker/feed" },
    "ucp": "https://snuepi.com/@kontorbedarf-becker/.well-known/ucp",
    "request_page": "https://snuepi.com/p/kontorbedarf-becker"
  },
  "booking": { "instant_booking": true, "who_can_book_directly": "customer_confirms_by_email",
               "max_amount_without_owner_ex_vat": 5000, "currency": "EUR", "lead_time_hours": 2,
               "must_provide": ["address", "photos", "access_instructions"], "deposit": null, "resale": "not_allowed" },
  "quotes": { "site_visit": { "required": "larger_jobs", "bookable": true, "price_ex_vat": 49,
                              "booking_page": "https://snuepi.com/@kontorbedarf-becker" } },
  "negotiation": { "allowed": false, "max_negotiations_per_sender_per_day": 20, "beyond_limit": "list_price_only" },
  "rate_limit": { "requests_per_minute": 60 },
  "outreach": { "unsolicited_sales_or_marketing": "not_accepted", "data_collection_for_training": "not_accepted" },
  "consumers": { "withdrawal_period_days": 14, "early_start_needs_explicit_consent": true },
  "updated_at": "2026-10-24"
}

For agent builders

Fetch the policy before contacting a business; cache it for a few minutes.
If phone_calls_from_agents is not_accepted, use the listed channels. Never phone repeatedly.
Identify as an AI and say whom you act for, in every call and message.
Never book above max_amount_without_owner_ex_vat without the business confirming.
Respect rate_limit, quiet_hours, max_contacts_per_agent_per_day and the negotiation limit; redialling until someone answers and probing for a floor price are not acceptable.
Collect everything in must_provide from your principal before booking, and tell them about any deposit and no_show_fee_percent.
If site_visit.required applies, book the site visit rather than asking for a price on the phone.
Never record the business's staff unless recording_of_staff allows it and you asked first.

Status

Draft v0.2, October 2026 (v0.1 published 24 October). v0.2 adds the terms small front desks told us they could not set: contact consent, phone hours, quiet hours, contact limits, deposits and no-shows, what the customer must provide, recording consent, resale and site visits. When the Personal Agent Protocol publishes its specification, snuepi will serve both. Feedback and proposals are welcome at nkoller@snuepi.com. Businesses on snuepi get a policy generated from their rules at https://snuepi.com/@<business>/agent-policy.json.