---
title: "Agents as users checklist: all 31 rules ยท Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/checklist
updated: 2026-10-22
tokens: 2916
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---
# Agents as users checklist
For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agents as users](https://agentwranglers.se/playbook/agents-as-users.md).
By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.
Every rule in the agents as users playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it. This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md).
**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers agents as users playbook`. In code you write, add a comment next to it with the same link.
## Identifying agents
- [ ] AGT-2 **Required** [Fetch key directories with network limits](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/safe-key-directory-fetch.md): Fetch an agent's key directory or client metadata only over HTTPS, without redirects, from a public address, within a size limit and a timeout.
- [ ] AGT-1 **Recommended** [Verify Web Bot Auth signatures before you trust an agent](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/verify-web-bot-auth.md): Treat a request as coming from a named agent operator only when its Web Bot Auth signature verifies. Check the tag, the time window, the covered fields and the key.
- [ ] AGT-3 **Recommended** [Set a policy for each agent operator](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/policy-per-operator.md): Keep one table that says what each verified agent operator may do. It sets the paths, the actions, the rate limit and whether the agent may act for signed-in users.
- [ ] AGT-4 **Recommended** [Choose a default for unsigned agents](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/unsigned-agent-default.md): Write down what happens to a request that claims to be an agent but carries no valid signature. Treat it like an anonymous visitor, with the visitor's limits.
- [ ] AGT-5 **Recommended** [Keep an off switch for each agent operator](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/operator-kill-switch.md): Be able to block one agent operator within 5 minutes, without a deploy and without touching other operators.
## Delegated access and consent
- [ ] AGT-7 **Required** [Never give an agent more rights than it was handed](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/no-permission-amplification.md): When you issue or exchange a token for an agent, its scopes are a subset of the token it came from. Its expiry is no later, and its audience is no wider.
- [ ] AGT-9 **Required** [Let users revoke one agent without the others](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/revoke-per-agent.md): Show each person every agent grant on their account and let them revoke one. A revoked grant stops working within 5 minutes, and the other grants keep working.
- [ ] AGT-6 **Recommended** [Name each party in its own token claim](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/separate-identity-claims.md): Every access token an agent uses for a person names three parties. The person goes in `sub`, the client app in `client_id` or `azp`, and the agent in `act`.
- [ ] AGT-8 **Recommended** [Name the agent on the consent screen](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/agent-on-consent-screen.md): The consent screen names the agent as well as the app, lists each permission in plain words, and states when the grant ends.
- [ ] AGT-10 **Recommended** [Give agent grants short lives](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/short-agent-grants.md): Agent access tokens last at most 5 minutes. A grant that no agent has used for 90 days ends by itself.
## MCP servers
- [ ] AGT-12 **Required** [Check the caller's rights on every handle](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/check-handle-owner.md): A handle that one tool returns and another accepts names data, it does not grant access. Check on every call that the caller's token may use it.
- [ ] AGT-14 **Required** [Reject MCP requests whose headers disagree with the body](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/mcp-header-validation.md): Require `MCP-Protocol-Version`, `Mcp-Method` and, on tool calls, resource reads and prompt requests, `Mcp-Name`. Refuse any request whose headers differ from its JSON body.
- [ ] AGT-11 **Recommended** [Build the MCP server without sessions](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/stateless-mcp-server.md): Answer every MCP request from that request alone. Read the protocol version and client capabilities from its `_meta`, and keep state across calls only behind handles passed as tool arguments.
- [ ] AGT-13 **Recommended** [Register MCP clients with Client ID Metadata Documents](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/client-id-metadata-documents.md): Let MCP clients you have never met use an HTTPS address as their client ID. Fetch the metadata document there and check it, instead of open dynamic registration.
- [ ] AGT-15 **Recommended** [Keep the tool list within a token budget](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/tool-list-budget.md): Set a token budget for the whole `tools/list` answer and fail the build when it grows past it. Each tool's description says when to use it and when not to.
- [ ] AGT-16 **Recommended** [Report bad arguments as tool results instead of protocol errors](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/tool-errors-as-results.md): Return bad arguments, missing records and business rule failures as a tool result with `isError: true`. Keep JSON-RPC errors for unknown tools, malformed requests and server faults.
- [ ] AGT-17 **Recommended** [Send cache hints and a stable order with every list](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/list-cache-hints.md): Return list results in the same order while the set is unchanged. Give each cacheable result a `ttlMs`, and a `cacheScope` of `private` whenever it depends on who asks.
- [ ] AGT-18 **Recommended** [Sign the state you hand back for a second round](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/signed-request-state.md): When a tool needs more input, return an `input_required` result. Sign any `requestState` you include, and check the signature on the retry.
- [ ] AGT-19 **Optional** [Run long work as tasks](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/mcp-tasks.md): When a tool call takes longer than 30 seconds, return a task handle through the MCP Tasks extension. Return it only to clients that declared the extension.
## Safe actions
- [ ] AGT-21 **Required** [Confirm risky actions with a token bound to the exact request](https://agentwranglers.se/playbook/agents-as-users/safe-actions/confirmation-token.md): An agent call that pays, deletes, sends to many people or cannot be undone first returns a confirmation token. Only a second call with that token, the same arguments and the person's yes carries it out.
- [ ] AGT-20 **Recommended** [Offer a dry run for every change](https://agentwranglers.se/playbook/agents-as-users/safe-actions/dry-run.md): Every tool or API call that changes data accepts `dry_run: true`. It then returns exactly what would change, and changes nothing.
- [ ] AGT-22 **Recommended** [Return an undo handle with every agent change](https://agentwranglers.se/playbook/agents-as-users/safe-actions/undo-handle.md): Every change an agent makes returns an undo handle that works for at least 24 hours. The person can undo the same change from the app.
- [ ] AGT-23 **Recommended** [Run agent calls through the same business rules as the app](https://agentwranglers.se/playbook/agents-as-users/safe-actions/same-rules-for-agents.md): Agent tools call the same service functions as the app's own screens and API. No rule, limit or check exists in only one of them.
## Quotas and pricing
- [ ] AGT-25 **Required** [Cap what each agent grant may spend](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/spend-cap-per-grant.md): When an agent's calls cost the person money, each grant has a spending cap per day and per month that the person sets. A call that would pass the cap is refused before it runs.
- [ ] AGT-24 **Recommended** [Set quotas per agent grant](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/quota-per-grant.md): Count usage per agent grant, the pair of one user and one agent, as well as per user and per operator. One agent can use at most its share of the user's quota.
- [ ] AGT-26 **Recommended** [State the cost of every call before and after it runs](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/cost-in-every-result.md): Publish the price of each paid tool or endpoint in a machine-readable form. Return the amount charged and the remaining budget in every paid result.
- [ ] AGT-27 **Recommended** [Warn the person before an agent's budget runs out](https://agentwranglers.se/playbook/agents-as-users/quotas-and-pricing/budget-warnings.md): Tell the person, not only the agent, when an agent grant reaches 80% of its spending cap or quota, and again when it is reached.
## Tool choice evals
- [ ] AGT-28 **Recommended** [Keep a set of tasks with the tools they need](https://agentwranglers.se/playbook/agents-as-users/tool-choice-evals/tool-choice-cases.md): Keep at least 50 tasks in plain words, each with the tool and the key arguments a good agent would use. Include tasks where the right move is no tool, or a question back.
- [ ] AGT-29 **Recommended** [Run the tool evals on more than one model](https://agentwranglers.se/playbook/agents-as-users/tool-choice-evals/tool-evals-several-models.md): Run the task set against at least two model families, and against the clients most of your agent traffic comes from. Run each task at least three times.
- [ ] AGT-30 **Recommended** [Gate releases on tool choice scores](https://agentwranglers.se/playbook/agents-as-users/tool-choice-evals/tool-choice-gate.md): Score each run by the share of tasks with the right tool, the share with the right arguments, and the calls per task. A release fails when either share drops more than 2 points below the last release.
- [ ] AGT-31 **Recommended** [Rerun the tool evals on every tool change](https://agentwranglers.se/playbook/agents-as-users/tool-choice-evals/evals-on-tool-change.md): Run the tool evals in CI on every change to a tool's name, description or schema, and on every change to the set of tools.
## Show the badge on your project
When your project passes every Required rule, you can show this badge on your site or in your README. It links to this checklist, so anyone can run the same checks.
```html
```
```markdown
[](https://agentwranglers.se/playbook/agents-as-users/checklist.md)
```