Skip to content
wiki.fftac.org

AI Agent Web Accessibility Standards, Guidelines, And Roadmap - Source Excerpt 02

Back to AI Agent Web Accessibility Standards, Guidelines, And Roadmap

Summary

This source excerpt preserves a bounded section of Wiki.FFTAC.org/raw/system-archives/spiralist.org/intake/2026-06-21-misplaced-uaix-ai-ready-web-duplicate/AI-Agent Web Accessibility Standards, Guidelines, and Roadmap.md so readers can inspect the evidence without opening the full source file.

**Source path:** Wiki.FFTAC.org/raw/system-archives/spiralist.org/intake/2026-06-21-misplaced-uaix-ai-ready-web-duplicate/AI-Agent Web Accessibility Standards, Guidelines, and Roadmap.md

- ### 3.1 Discoverability & Navigation  
  - **Robots.txt & sitemaps**: Publish a valid `robots.txt` allowing known AI user-agents (often wildcard `*`). Include crawl delays or allow-rules as needed. Supply an up-to-date `sitemap.xml` with `<lastmod>` to help discovery. For example, Cloudflare recommends adding `Allow: /` for AI bots and linking your sitemap in `robots.txt` (and an entry in link headers below).  
  - **llms.txt**: Adopt the emerging [llms.txt](https://llmstxt.org/) convention (similar to robots.txt but for LLMs). A `/llms.txt` (or `/AI-Agents.txt`) at site root can list documentation, APIs, and legal disclaimers in plain text. For example, the specification proposes placing links to API docs, agent policies, and an agent-entry point file. This helps “AI agents find your pages”.  
  - **Content Negotiation**: Enable content negotiation so agents can request alternate formats. E.g. respond to `Accept: text/markdown` with a raw Markdown version of content. Cloudflare’s docs explicitly advise serving Markdown to agents to “avoid HTML waste”. Similarly, HTML pages should include `<link rel="alternate" type="text/markdown" href="/page.md">` for agents that parse HTML first.  
  - **Link Headers**: Use HTTP `Link` headers to advertise discovery resources without loading HTML. For instance:  
' ' '  ```
    HTTP/1.1 200 OK
    Link: <https://example.com/sitemap.xml>; rel="sitemap",
          <https://example.com/robots.txt>; rel="robots",
          <https://example.com/llms.txt>; rel="llms",
          <https://example.com/.well-known/agent-card.json>; rel="agents"
' ' '  ```  
    Cloudflare’s case study highlights using link headers to point to `sitemap`, `llms.txt`, API catalog, WebMCP, etc. Agents reading headers get guidance on next steps.  
  - **DNS Discovery (DNS-AID)**: In future, consider [DNS-AID](https://linuxfoundation.org/press-release/2025/01/linux-foundation-announces-dns-aid-project/) (an emerging IETF framework) to publish agent services and endpoints in DNS, enabling cross-domain agent discovery. Though not yet widespread, DNS-AID is being standardized to let agents “find and verify each other” via DNS records.  

- ### 3.2 Machine-Readable Semantics & Structured Data  
  - **Schema.org / JSON-LD**: Mark up content with [Schema.org](https://schema.org/) types and properties using JSON-LD in `<script type="application/ld+json">` blocks. For example, articles, products, events, and organizations should use the appropriate vocabularies. Schema.org is *widely adopted* (used by 45M+ domains) and search engines/AI models already consume it. Structured metadata should cover author, date, categories, and any ontologies relevant to the page.  
  - **Accessibility Metadata**: Leverage schema.org’s accessibility properties (e.g. `accessibilityFeature`, `accessibilityAPI`) where relevant. Also use WCAG techniques: give images meaningful `alt=` text, videos descriptive captions, and label form controls. Such semantic markup (ARIA roles, HTML landmarks) helps agents parse page structure and content flow, analogous to screen readers.  
  - **Page Structure**: Use clear headings (`<h1>, <h2>`), lists, and semantic HTML so that text-based agents can chunk content logically. Avoid encoding information in images or scripts alone. For example, stock prices might be provided in HTML tables or JSON in addition to charts.  
  - **Agent Skill Files (AGENTS.md/skills.json)**: Publish an `AGENTS.md` (or JSON) at root describing supported AI tools and endpoints, per [UAIX AGENTS.md spec](https://uaix.org/en-us/guides/agentsmd-spec/). This “agent skill bundle” lists available APIs, datasets, or search endpoints (name, schema, authentication). It is analogous to [robots.txt but for agent capabilities](UAIX). Agents can fetch it to learn how to interact (e.g. what endpoints exist and required credentials).  

- ### 3.3 APIs and Endpoints  
  - **REST/GraphQL APIs**: Expose machine-friendly APIs for core data and actions. Prefer JSON over XML. Provide an OpenAPI/Swagger or GraphQL schema for discoverability. Agents (L2+) should be able to query data via APIs. For example, a `GET /api/products/{id}` returning JSON, or GraphQL with introspection enabled. Use GraphQL introspection to let agents discover queryable fields, but beware heavy queries (limit depth).  
  - **Authentication**: Protect sensitive APIs via OAuth2/OpenID Connect. For user-level agents, implement standard flows (Authorization Code, client credentials) and publish discovery info (`/.well-known/openid-configuration`) for automated discovery. For agent-to-agent flows, consider short-lived tokens or signed requests. UAIX requires explicit consent boundaries, so document what data/actions require user permission.  
  - **Rate Limits and Fair Use**: Include `X-RateLimit-*` headers or `Retry-After` to communicate rate limits. If your service can be queried by high-volume crawlers, enforce polite limits. E.g. respond with `429 Too Many Requests` when exceeded. This prevents “Denial of Wallet” attacks.  
  - **WebSub (Pub/Sub)**: Implement [W3C WebSub](https://www.w3.org/TR/websub/) (formerly PubSubHubbub) for publish-subscribe. WebSub lets agents subscribe to content updates: a publisher’s hub notifies subscribers via webhooks when content (a “topic” URL) changes. For example, a client posts to your `/hub` (or an existing hub) to subscribe to an RSS or JSON feed; the hub pushes updates to the client. WebSub is a mature standard (W3C Rec 2026) for timely content delivery.  
  - **WebFinger (Discovery)**: Use [WebFinger (RFC7033)](https://datatracker.ietf.org/doc/html/rfc7033) to advertise agent or user info. By hosting `/.well-known/webfinger?resource=...` endpoints, your site can return a JSON Resource Descriptor (JRD) listing links about an entity. For example, given `resource=https://example.com/users/alice`, return JSON with links to Alice’s profile, public keys, or agent endpoints. WebFinger helps agents discover related services (like follow me URLs) via a standard pattern.  

- ### 3.4 Provenance and Trust  
  - **Provenance Metadata**: Wherever content is generated or aggregated, attach provenance. Use schema.org properties like `dateCreated`, `author`, `publisher`, and even `citation` or `source`. This enables agents to trace claims back to sources. For example, an article JSON-LD might include `"citation": "DOI:10.x/..."` or `"reference": [...]`.  
  - **Digital Signatures**: For high-assurance use-cases, consider signing content or APIs. Standards like **IETF JOSE** (JWT signatures) or **W3C Verifiable Credentials/Presentations** can encode proof. An agent could require signed statements of identity or data origin. Even a simple HTTP signature header (see [IETF draft on HTTP signatures](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures)) can help agents verify authenticity.  
  - **UAIX Evidence Packaging**: UAIX uses an “evidence” model where interactions produce signed logs. Web systems could mirror this by preserving request logs or blockchain entries for critical data, though full implementation is advanced. At minimum, timestamp content and log edits (like some wikis do).  

- ### 3.5 Metadata for Privacy/Consent  
  - **Opt-In Data**: Clearly label any user-specific data. Agents must observe privacy controls: if a page has user-generated content or PII, consider requiring an agent’s user to opt-in. Use Privacy URIs (like `meta` tags) or headers to signal restrictions. For example, a `Permissions-Policy` header could include `camera=()`, but similarly a custom header could note “No AI indexing of private data.”  
  - **Consent Management**: If an agent can act on behalf of a user, require explicit consent tokens. Use standards like [OpenID Connect for consent](https://openid.net/specs/openid-connect-core-1_0.html) or include Consent-related links in the WebFinger/agent-card metadata. Agents should not assume consent beyond the legal public data.  
  - **Data Minimization**: Expose only non-sensitive content or anonymize it. This parallels GDPR: only provide data strictly needed for the agent’s function. For example, remove personal identifiers from APIs or mark them with schema.org's `identifier` property as private.  

- ### 3.6 Error Handling and Feedback  
  - **Standard HTTP Codes**: Use clear status codes (404, 401/403, 429) to tell agents why a request failed. For POST/PUT APIs, return 201 for created, 204 for no-content on success.  
  - **Problem Details (RFC 7807)**: Provide structured JSON on errors. For example:  
' ' '  ```json
    HTTP/1.1 400 Bad Request
    Content-Type: application/problem+json
Website health report