Agents as users playbook

A playbook for the provider side, when other people's AI agents use your product. It starts with telling agents apart by signed requests, and with a policy and an off switch per operator. Then it covers access an agent holds for a person, with a consent screen that names the agent and revocation per agent. It shows how to build an MCP server to the July 2026 specification. It ends with actions an agent can preview and undo, and with quotas and spending caps per agent. Evals then show whether agents pick the right tool. Publishing the files that help agents find you is in the website playbook.

Chapters

1. Identifying agents

   Tell agents apart by signed requests, not user agent strings. Set a policy per operator, a default for unsigned traffic and an off switch for each.

   • Required 1
   • Recommended 4

2. Delegated access and consent

   When an agent acts for a person, name the person, the app and the agent in each token. Show the agent at consent, never widen rights, revoke per agent.

   • Required 2
   • Recommended 3

3. MCP servers

   Build MCP servers to the 2026-07-28 specification. No sessions, metadata documents for clients, checked headers, small tool lists, cache hints and tasks.

   • Required 2
   • Recommended 6
   • Optional 1

4. Safe actions

   Let agents preview each change, confirm risky ones with the person and undo their own work. Every agent call passes the same business rules as the app.

   • Required 1
   • Recommended 3

5. Quotas and pricing

   Give each agent grant its own quota and spending cap. State what every call costs, before and after it runs, and warn the person before the money runs out.

   • Required 1
   • Recommended 3

6. Tool choice evals

   Keep a fixed set of tasks with the tools they need. Run it on several models, gate releases on the score and rerun it when a tool definition changes.

   • Recommended 4

All 31 rules on one page

This is a lot to check. An Expert can check it for you.

Related playbooks

• Ready for AI agents

  In the Website playbook. Publish llms.txt, Markdown copies, server cards and agent cards, so agents can find what you offer.

• Hostile agents and bots

  In the Adversarial testing playbook. Some agents are hostile. Verify who they are, limit bulk reads and keep their changes undoable.

• Structured output and tools

  In the AI features playbook. Shape each tool with a strict schema, errors a model can act on and calls that are safe to repeat.

• Roles and permissions

  In the Accounts and identity playbook. An agent never holds more rights than the person who granted it, checked on every call.