Glossary

A – E #

Action

One thing a customer can get done on a website: book a job, ask for a quote, request a callback, get in touch. Each one is a single entry in the Action Graph, with the page it lives on, its fields, and whether the owner has approved it.

Action Graph

The written list of what a site can do, in a form a machine can read. Every part of Frontlatch works from it. See /docs/action-graph.

Affordance

One way in to an action. A form is one, a phone link is another, an embedded booking widget is a third. One action can have several.

Agent

Software acting on a website for a person, such as AI told to book a plumber, rather than a person clicking. The tracker only says “agent” on real evidence. One weak signal on its own is a suspected agent instead.

Agent-callable

Whether AI could do one particular action directly, not just whether the site has a form. We only say yes on positive evidence, such as a published tool or a form with no CAPTCHA in the way.

Agent-readiness score

A number out of 100 for how much of what AI needs is present on a website. Agent-ready is 70 and above, partially ready is 40 to 69, and invisible to agents is below 40. See /docs/agent-readiness-score.

AI crawler

A bot that reads websites to train or index an AI model, rather than to do something for a person. The tracker records these but never counts them as agent traffic.

AI referrer

A visit that came from an AI answer: someone read an AI reply and followed a link. A person is on the site, so it is not counted as an agent.

ARD, and the catalogue at /.well-known/ard.json

A small file at /.well-known/ard.json listing what a business offers and how to act on it, so an agent can find the actions before loading a page. Published as a standard in June 2026. Of the fifteen sites scanned on 25 August 2026, none had one.

Barrier

Something standing between a correctly filled form and a finished action: a CAPTCHA, a login, a payment step, a one-time code. Barriers are recorded and reported.

Beacon

The small message the tracker sends when a visitor leaves a page, about 200 bytes. It is never sent during loading.

Bot-other

The tracker’s label for a bot that is not an agent: search crawlers, SEO tools, uptime checkers and AI training crawlers. Kept on its own line so crawler volume is never mistaken for agent demand.

CAPTCHA

The “prove you are not a robot” step. It stops a customer’s AI just as it stops a bot, so any action behind one is closed to agents. The scanner marks it down.

Claim

The step where the owner of a listed business says the listing is theirs, at /claim, by proving they control the domain. Claiming is not approval: nothing runs until the owner switches an action on in /app. See /docs/verification.

Complete

Whether we hold a full, faithful map of an action. It says nothing about permission, which is executable.

Consent record

What the owner was shown when they approved an action, kept as data. If the action ever differs from it, the action stops until a person confirms again.

Do Not Track and Global Privacy Control

Two ways a browser can say “do not count me”. If either is on, the tracker does nothing. Brave and DuckDuckGo send Global Privacy Control by default, which is why your own test may look like a failure.

Effect, or side effect

What finishing an action does in the world: emails the business, creates a record, takes a slot, takes payment. Effects come from a fixed list, so an owner’s approval can be checked against something.

Executable

Whether the owner has allowed an action to run for real. A perfectly mapped action on a site whose owner has never heard of us is complete but not executable, which is the normal state.

F – P #

Fix list

Everything the scanner found that has a named remedy, as instructions for whoever maintains the site. It is free and complete; nothing is held back for a paid tier.

Fixture

A saved example file used in tests so behaviour does not drift. The scanner has ten.

Gateway, and frontlatch.com/mcp

The one hosted endpoint, https://frontlatch.com/mcp, that agents call instead of navigating a business’s website. It finds businesses, lists their actions, and reads any site. The tool that acts refuses everything except a claimed business that has switched an action on. See /products/gateway.

Grade

The word under the score: agent-ready, partially ready, or invisible to agents.

Headless browser

A browser with no window, driven by software. It is a strong sign of automation, but not strong enough on its own to call a visit an agent.

Indexed

A listed business whose site has been read for actions an agent can do, so the gateway can describe them. This is a reading, not permission: an indexed business still refuses actions unless its owner has claimed it and switched one on.

JSON-LD

A block of machine-readable facts inside a page: the kind of business, hours, phone, address and services. Without it an agent has to guess from the text.

llms.txt

A plain text file at the root of a site describing it for language models. The scanner looks for it alongside robots.txt, sitemap.xml and the ARD catalogue.

Locator

How to find an element on a page again, with an honest note on whether it will survive the next site update.

Mappability

The share of a site’s detected actions we can map completely. A site with no actions scores zero. On 27 service businesses it was 40.7% (4 Sep 2026).

MCP, and a persistent endpoint

The Model Context Protocol: a connection an agent can open at any time to ask what a business offers and to act on it, whether or not anyone has the site open. It is one of three discovery routes the scanner checks, with ARD and WebMCP.

Non-action form

A form that looks like an action but is not one an agent could use, such as a search box or newsletter signup. These are left out of the scores.

Provenance

How we came to believe something and how sure we are: read from the markup, seen in a real browser, inferred, or confirmed by the owner. Only an owner’s confirmation can reach certainty.

R – Z #

Redaction

What is removed from a scan report before it is published: the business name, website address, phone numbers and booking links. A final check refuses to publish a report if any of them survive.

robots.txt

A file at the root of a site saying which automated visitors may read which parts. The scanner reads it to see whether agents are locked out, and obeys it.

Sandbox, or test mode

Practising an action without anything reaching the business. It is the default everywhere. Passing in sandbox shows an action works; it is never permission to run it for real.

Schema version

The version of the Action Graph format a file uses, currently 0.1. A reader refuses a newer version rather than guessing at the parts it cannot see.

Semantic type

What a form field means, as opposed to what the browser thinks it is. Two plain text boxes may be a name and an address, and an agent that cannot tell them apart cannot act.

Suspected agent

The tracker’s label when the evidence is real but not enough. A single automation signal on its own lands here, so doubt is kept rather than rounded up to an agent.

business index, the

Every service business Frontlatch has listed from public OpenStreetMap data (ODbL licence), each with a page under /businesses. Listings are free, read-only and searchable. Every listing links to “Correct or remove this listing”, where the owner can have it taken down.

Trust invariant

The rule everything is built around: no code path may ever run a real action on a business that has not verified that action type, and test mode is the default everywhere.

Unverified, sandbox-tested, verified

The three states an action can be in. Unverified is the default and nothing runs. Sandbox-tested means it worked in test mode and still cannot run for real. Verified means the owner confirmed it, and the confirmation is recorded.

Verified completed action

The unit we charge for: one real outcome, such as a booked job or an appointment, through an action the owner approved. Attempts and duplicates do not count. Each comes with a signed receipt and a seven-day dispute window. See /docs/how-billing-works.

Web Bot Auth

A way for an agent to sign its requests so a site can tell who is calling. The tracker notices the signature but does not check it.

WebMCP

A proposal for a page to tell the browser what it can do, so an agent can call those actions by name. Browsers have not shipped it yet. It only works while the tab is open, which is why a persistent endpoint is separate.

Widget, or booking widget

An embedded scheduler from a third party, such as ServiceM8, Cliniko, Halaxy, Calendly or Jobber. It is a real booking action, but its fields sit inside a frame we cannot read, so the graph records it as opaque.