Glossary

A – E #

Action

One thing a customer can get done on a website: book a job, ask for a quote, request a callback, send an enquiry, get in touch. In the Action Graph it is a single entry with an identifier, a kind, the page it lives on, the ways in, the fields, the site’s own rules about those fields, what happens when it completes, and whether the owner has approved it.

Action Graph

The written list of what a site can do, in a form a machine can read. It is a versioned contract — currently 0.1 — and it is the single interface every part of the system binds to. See /docs/action-graph.

Affordance

One door onto an action. A form is a door; a phone link is a door; an embedded booking widget is a door. One action can have several, which is why the graph records how an action is reached separately from what the action does.

Agent

Software acting on a website on a person’s behalf — an AI assistant told to book a plumber, rather than a person clicking. In the tracker it is one of four verdicts, and it is only assigned on real evidence: a declared user-agent, a signed identity, or at least two independent fingerprint signals.

Agent-callable

Whether an agent could actually complete one particular action, as opposed to whether the site has a form on it. It is computed from positive evidence only — a declared tool, an advertised endpoint, a published catalogue, a known booking widget, or a form complete enough to fill with no CAPTCHA in front of it — and there is no "nothing looked broken" route to true. It describes an action; the score describes a site, and the two are deliberately separate.

Agent-readiness score

A number out of 100 for how much of what an AI assistant needs is actually present on a website. Five categories worth twenty points each: crawlability and discovery, structured data, action affordances, form quality and agent interface. Three bands: agent-ready at 70 and above, partially ready from 40 to 69, invisible to agents below 40.

AI crawler

A bot that reads websites to train or index a model, rather than to do something for a person. GPTBot, ClaudeBot, PerplexityBot and their kind. The tracker classifies these as bot-other and records the platform, and never counts them as agent traffic — counting them would make every site look busy with agents on day one.

AI referrer

A visit that arrived from an AI answer — somebody read a response in ChatGPT or Perplexity and followed a link. Commercially interesting and not the same thing as an agent: a person is on the site. A referrer never moves the tracker’s verdict off human.

ARD, and the catalogue at /.well-known/ai-catalog.json

A small file at a known address on a site, listing what the business offers and how to act on it, so an agent can discover the actions before loading a page. Agent Readiness Discovery, published as a discovery standard in June 2026. Of the fifteen Sydney sites scanned on 25 August 2026, none published one — source: packages/scanner/benchmark/reports/.

Barrier

Something standing between a correctly filled form and a completed action. A CAPTCHA, a login, a payment wall, a one-time code, a queue for human review. It is not a validation, because the form is filled correctly, and it is not a side effect, because nothing has happened yet. Barriers are recorded and reported, and they deliberately do not affect whether a map counts as complete.

Beacon

The small message the tracker sends when a visitor leaves a page. One per page view, roughly 200 bytes, sent on leaving or after twenty seconds — never during loading. The collector treats every beacon as a string a stranger POSTed and trusts nothing in it.

Bot-other

The tracker’s verdict for a bot that is not an agent: search crawlers, SEO tools, uptime monitors, AI training crawlers. Reported on its own line so that nobody can mistake crawler volume for agent demand.

CAPTCHA

The "prove you are not a robot" step. It stops a customer’s AI assistant exactly as well as it stops a bot, and an assistant will not attempt one — it hands back to the person or gives up. Any action behind a CAPTCHA is closed to agents, which is why the scanner penalises it and why it shows up as a barrier in the Action Graph.

Complete

A property of our knowledge, not of anybody’s permission: do we have a full, faithful map of this action? Seven things must all hold, including a drivable door, a usable way to send it, a field an agent may fill, no required field whose meaning is unknown, a way to reach the customer back, stated consequences, and provenance throughout. Kept strictly apart from executable.

Consent record

What the owner was actually shown at the moment they approved an action, stored as data rather than as a tick. It mirrors the whole disclosure — the effects, whether it is reversible, whether the business now owes somebody something, whether personal information is transmitted, whether money moves, whether a real slot is held, and the summary sentence — and it is compared against what the action does every time a decision to execute is made. Any divergence stops the action until a human re-confirms.

Do Not Track and Global Privacy Control

Two ways a browser can say "do not count me". If either is present the tracker stops before it starts: no listeners, no counting, no request. Brave and the DuckDuckGo browser send Global Privacy Control by default, which is the most common reason somebody’s own test of their own install looks like a failure.

Effect, or side effect

What completing an action does in the world — emails the business, creates a record in their software, takes a slot out of their day, opens a ticket, takes payment. It is a fixed list of twelve rather than free text, because a sentence cannot be checked by a machine and an owner’s approval has to be compared against something. An action whose consequences cannot be stated is invalid.

Executable

A property of the owner’s consent, not of our knowledge: may this action fire for real? A perfectly mapped action on a site whose owner has never heard of us is complete and not executable, and that is the normal state of every action ever mapped.

F – P #

Fix list

Everything the scanner found that has a named remedy, in the order the score reads them. Instructions for whoever maintains the site, free, and the whole list — nothing is held back for a paid tier. On a published report the wording is rewritten so that it instructs rather than advertises, and a report in which a first-person claim survives is refused publication.

Fixture

A committed example file used to test something and to keep its behaviour from drifting. The scanner has ten and asserts their exact scores; the Action Graph package has three, one of which is the only verified example in the repository — a hand-written confirmation that exists so the gate can be tested against a positive case, not a record of any real business agreeing to anything.

Grade

The word under the score. Agent-ready at 70 and above; partially ready from 40 to 69; invisible to agents below 40.

Headless browser

A browser running with no window, driven by software. It is one of the strongest fingerprint signals the tracker uses, and it is weighted 0.70 out of the 1.00 needed to call something an agent — high, but deliberately not high enough on its own.

JSON-LD

A block of machine-readable facts embedded in a page: what kind of business this is, its hours, its phone number, its address, the services it offers. Without it an agent has to guess all of that from the prose. It is what the scanner’s structured-data category measures.

llms.txt

A plain text file at the root of a site describing what the site is and does, written for language models. One of the four well-known files the scanner probes, alongside robots.txt, sitemap.xml and the ARD catalogue.

Locator

How to find a particular element on a page again — a selector, an accessible name, a link target — together with an honest judgement about whether it is likely to survive the next theme update. A fragile locator is a recorded risk rather than a surprise later.

Mappability

The share of a site’s detected actions that yield a complete map. A site with no actions at all scores zero, not one, because the alternative reading would make an empty site our best result. Measured across fifteen Sydney sites on 25–26 August 2026 at 73.3%, eleven of fifteen — source: packages/mapper/benchmark/results.json.

MCP, and a persistent endpoint

A connection an agent can open at any time to ask what a business offers and to act on it, whether or not anybody has the site open in a browser. The Model Context Protocol. It is the route that still works at 2am, and it is the third of the three discovery routes the scanner checks.

Non-action form

A form that matches action wording but is not an action an agent could complete: a search box, a newsletter signup, or a form with nothing to submit. These are excluded from both the detected actions and the form-quality score, because scoring a business’s form quality on the strength of its property-search box is a false positive with a number attached.

Provenance

How a thing came to be believed, and how sure we are: parsed from the markup, read from structured data, observed in a real browser session, inferred, or confirmed by a human at the business. Every part of the Action Graph that asserts something carries one, with a confidence and a receipt. Only an owner’s confirmation may ever reach certainty; nothing we work out ourselves is certain.

R – Z #

Redaction

What is removed from a scan report before it is published: the business name and website address, phone numbers and booking-widget URLs, and the raw page markup. It is done by rebuilding the identifying fields from a safe vocabulary rather than by filtering them, and a final check refuses to publish a report in which a hostname, a business-name token or a phone number survives.

robots.txt

A file at the root of a site saying which automated visitors may read which parts of it. The scanner reads it to see whether agents are locked out — either by a blanket disallow or by naming AI agents specifically — and it obeys what it finds.

Sandbox, or test mode

Running an action for real practice without anything reaching the business. It is the default everywhere, and passing in sandbox is deliberately its own state rather than a step towards approval: sandbox success is evidence that an action works, and it is never permission to fire it. Conflating those two is precisely the failure the trust rule exists to prevent.

Schema version

The version of the Action Graph contract a file speaks. Currently 0.1. A reader refuses a file from a newer version outright rather than reading the parts it recognises, because the parts it cannot see might carry a limit or a consequence, and ignoring a constraint is the worst possible way to be forgiving.

Semantic type

What a form field means, as opposed to what the browser thinks it is. Two plain text boxes may be a customer’s name and a property address, and an agent that cannot tell them apart cannot act. There are 29, including three that exist for safety: anti-spam fields an agent must never touch, hidden metadata an executor must echo back exactly, and unknown, which blocks completeness rather than being guessed at.

Suspected agent

The tracker’s verdict when the evidence is real but ambiguous. It exists so that ambiguity is carried rather than rounded up into a confident answer. A single automation signal with nothing else alongside it lands here, and that is intended.

Trust invariant

The rule everything else is built around: no code path may ever execute a real action on a business that has not verified that action type, and test mode is the default everywhere. It is expressed as data rather than as a policy — the type will not let an action be marked approved without the approval attached, the validator rejects the same thing arriving as a file, every constructor produces an unapproved action, and the gate re-derives permission from the evidence every time rather than trusting a status.

Unverified, sandbox-tested, verified

The three states an action can be in, in order of what they permit. Unverified is the default and nothing runs. Sandbox-tested means it has been exercised in test mode and still cannot run for real. Verified means the owner confirmed, and the confirmation is present as data: who, when, how, a reference to the audit record, the limits they set and the disclosure they saw. There is no revoked state — revocation moves an action back to unverified, which fails closed.

Verified completed action

The unit that gets charged for. One real outcome — a booked job, a submitted quote, an appointment — that ran through an action the owner had approved and actually completed. Duplicates do not count, attempts do not count, and nothing has ever been billed, because the metering layer does not exist yet.

Web Bot Auth

A way for an agent to sign its requests so a site can tell which agent is calling. The tracker detects the signature headers and does not verify the signature — no key fetch, no cryptographic check — so the claim it makes is "this request presented a signed agent identity", not "this is a verified agent", and its confidence is capped below certainty for exactly that reason.

WebMCP

A way for a page to tell the browser what it can do, so an agent using that browser can call those actions by name instead of scraping and guessing. It is a proposal, not a shipped browser feature: it is declared through navigator.modelContext, which browsers have not implemented, so using it today means loading the @mcp-b/global polyfill. It lives and dies with the open tab, which is why a persistent endpoint is a separate thing.

Widget, or booking widget

An embedded scheduler from a third party — ServiceM8, Cliniko, Halaxy, Tradify, Calendly, Jobber. It is a genuine booking action whose fields sit inside a frame nobody outside it can read, so the Action Graph records it as opaque with no inputs, which is a different claim from "this action has no fields". The scanner matches widgets structurally against booking URLs, never against page text, so a "powered by" credit in a footer is not a booking widget.