# Agentic Checklist > Access, machine-readable data, protocol, payment, operations and governance steps so AI agents can read your site, discover what you offer and act on your behalf. Emerging protocols are clearly labeled by evidence level. This file is the Markdown version of . Open the page to tick items off and check your site automatically. Last verified: November 1, 2026 ## Agent access and bot management Correct robots.txt rules are not enough; WAFs, CAPTCHAs, rate limits and geo-blocking can also stop agents. This section verifies that legitimate agents can actually reach the site. ### Do not return blocks or challenge pages to AI bot user agents Priority: High priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Bot management tools often return a 403 or a JavaScript challenge to clients they do not recognize. The agent then sees an empty block page instead of content. **How to do it:** 1. Request key URLs with common AI user agents. 2. Record cases returning 403, 429 or a challenge page. 3. Fix WAF rules to allow verified bots. **How to verify:** curl -A "Mozilla/5.0 (compatible; OAI-SearchBot/1.0)" -s -o /dev/null -w "%{http\_code}" https://{site}/ returns 200. **AI prompt:** ```text Write a curl script that requests the {site} homepage and two key pages with different AI user agents, and explain how to detect 403s, 429s or JavaScript challenge pages. ``` ### Verify bot identity with published IP lists, not user agents Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** User agents are easy to spoof. OpenAI, Anthropic and Perplexity publish official IP lists for their bots; Google and Bing are verified with reverse DNS. **How to do it:** 1. Fetch openai.com/gptbot.json, searchbot.json, chatgpt-user.json; claude.com/crawling/bots.json; perplexity.ai/perplexitybot.json and perplexity-user.json. 2. Define these ranges as verified bots in the WAF and refresh them automatically. 3. Use reverse and forward DNS to verify Googlebot and Bingbot. **How to verify:** IPs of requests claiming to be OAI-SearchBot in logs match the searchbot.json ranges. **AI prompt:** ```text Write a script that compares requests in {site} logs claiming to be OpenAI, Anthropic or Perplexity bots with the official IP lists, and explain how to separate spoofed bot traffic. ``` **Sources:** , , , ### Use robots.txt for policy, not IP blocks Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** A bot blocked at the IP level cannot read robots.txt either, so it cannot learn your preference and issues become hard to diagnose. Keep IP blocks for abuse only. **How to do it:** 1. Express bot policy in robots.txt. 2. Limit IP blocks to abuse and spoofed bots. 3. Check blocked IPs do not overlap official bot ranges. **How to verify:** The WAF IP block list contains no official AI bot IP ranges. **AI prompt:** ```text Suggest a method to audit the {site} WAF IP block list for overlap with official AI bot ranges, and explain the difference between robots.txt and IP blocking. ``` **Sources:** , ### Configure CDN and WAF “block AI bots” settings deliberately Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** Cloudflare and similar providers offer one-click settings to block AI bots, and on some plans these may be on by default. They can also affect search bots. **How to do it:** 1. Check the AI bot settings in your CDN and WAF dashboard. 2. Keep search and user-fetch bots allowed; set training bots per your policy. 3. Record changes in the bot policy document. **How to verify:** The CDN dashboard’s AI bot settings and their rationale are recorded, and search bots are not blocked. **AI prompt:** ```text If {site} uses Cloudflare or a similar CDN, list which AI bot settings to check and explain how to manage training bots without hurting search visibility. ``` **Sources:** ### Rate-limit without cutting agents off; return 429 with Retry-After Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agents request several pages in a short time. Aggressive limits break tasks midway, while a 429 with Retry-After, instead of a 403, tells the client what to do. **How to do it:** 1. Define separate, reasonable limits for verified bots. 2. Return 429 with a Retry-After header when limits are exceeded. 3. Monitor bot requests blocked by rate limits. **How to verify:** Logs show a low 429 share for verified bot requests, and 429 responses include Retry-After. **AI prompt:** ```text Write a recommended rate-limit policy for verified AI bots and agents on {site}, with a sample server configuration using 429 and Retry-After. ``` ### Let agentic browsers complete core flows without CAPTCHAs Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agentic browsers such as ChatGPT agent, Perplexity Comet or Gemini in Chrome navigate like real browsers. A mandatory CAPTCHA in search, cart or form steps stops the task. **How to do it:** 1. Test search, product, cart and contact flows with an agentic browser. 2. Use risk-based challenges instead of showing CAPTCHAs to every visitor. 3. Keep human confirmation for critical steps like payment, but keep the steps before it smooth. **How to verify:** An agentic browser given “add product X on {site} to the cart” reaches the cart step without hitting a CAPTCHA. **AI prompt:** ```text Write 5 core task scenarios to test {site} with an agentic browser (search, product comparison, add to cart, contact form, order tracking) and what to record for each. ``` ### Do not hide product, price or policy information behind login or cookie walls Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Agents cannot sign up on a user’s behalf and often cannot log in. Pages that require login to see price or stock drop out of comparisons. **How to do it:** 1. List pages that require login. 2. Make product, price, shipping and returns information available without login. 3. If B2B prices are private, at least state a price range or “request a quote” clearly. **How to verify:** A product page fetched with curl without login shows price and stock. **AI prompt:** ```text Suggest a method to find product, price and policy information on {site} that is not accessible without login or cookie consent, and write solutions for agent access. ``` ### Make sure the cookie banner does not hide content from the HTML Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Some consent tools do not load page content until consent is given, or cover it entirely. Agents and bots then only see the consent text. **How to do it:** 1. Open the page with curl and an agentic browser without giving consent. 2. Confirm the main content is in the HTML. 3. Check the banner is an accessible, dismissible element. **How to verify:** HTML fetched without consent contains the main content text. **AI prompt:** ```text Write steps to test whether the {site} cookie consent banner blocks bots and agentic browsers from content, and suggest a fix that stays compliant with privacy law. ``` ### Check that geo-blocking does not exclude agent infrastructure Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** AI bots and agents mostly come from data centers in the US and Europe. A site open only to one country becomes invisible by blocking them. **How to do it:** 1. List geo-blocking and geo-redirect rules. 2. Exempt verified bot IP ranges from them. 3. If you redirect by country, confirm bots can reach every language version. **How to verify:** A curl request from abroad (e.g. a US server) returns 200 and the right content for {site}. **AI prompt:** ```text Explain how geo-blocking and country-based redirects could affect AI bots on {site}, and suggest ways to test with requests from different regions. ``` ### Prepare to recognize signed agent requests (Web Bot Auth) Priority: Low priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Web Bot Auth is an IETF draft that lets bots prove their requests with HTTP message signatures. Some CDNs and agent providers have started using it to identify verified bots. **How to do it:** 1. Check whether your CDN supports signed bot verification. 2. If it does, allow verified signed agents. 3. Track the draft’s progress. **How to verify:** The status of signed bot verification is recorded in CDN or WAF settings. **AI prompt:** ```text Briefly explain what the Web Bot Auth draft (HTTP Message Signatures for Bots) is and how to evaluate it on the CDN side for {site}. ``` **Sources:** , ### Decide deliberately on pay-per-crawl and 402-based access Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Some CDNs offer models to charge AI crawlers. This can create revenue but, applied wrongly, lowers visibility. **How to do it:** 1. Decide which bots you would charge. 2. Keep search and user-fetch bots out of the scheme. 3. Add the decision and rationale to the bot policy. **How to verify:** The bot policy records the pay-per-crawl decision and scope. **AI prompt:** ```text Assess the pros, cons and visibility impact of paid access for AI crawlers on {site}, and recommend which bots should stay out of scope. ``` **Sources:** ### Verify agent access with a test matrix that includes a control request Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** When a bot sees an error, you need a comparison with a normal browser request to tell whether the problem is the bot or the page. **How to do it:** 1. Build a matrix of key URLs and bot user agents. 2. Add a normal browser request as the control for each row. 3. Compare status code, response time and content size. **How to verify:** In the test matrix, status codes and content sizes for bots match the control request. **AI prompt:** ```text Write an access test script for {site} covering 10 key URLs and 8 AI user agents, using a normal browser request as the control, and suggest an output format. ``` ### Rerun agent access tests regularly and automatically Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** WAF rules, CDN settings and releases change silently. A one-off test is outdated after the next change. **How to do it:** 1. Schedule the access test matrix daily or weekly. 2. Alert when a result changes. 3. Keep results with history. **How to verify:** The last run of the scheduled access test is no older than 7 days. **AI prompt:** ```text Design a setup for {site} that runs AI bot access tests weekly with GitHub Actions or cron and alerts on changes. ``` ## Agent-readable content Agents read pages as raw HTML, as simplified formats like Markdown, or through the accessibility tree. This section aims to deliver content cleanly and completely through all three. ### Publish llms.txt as a low-cost guide, not a ranking lever Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer, Content. **Why it matters:** llms.txt is a proposal, not a standard. Google says it has no positive or negative effect on visibility, and a May 2026 analysis found 97% of files received no requests. It is still a cheap map for documentation-focused agents. **How to do it:** 1. Create /llms.txt at the root in Markdown. 2. Summarize the site’s purpose in one paragraph and list key pages in sections. 3. Use log analysis to see whether it is actually requested. **How to verify:** curl -s https://{site}/llms.txt returns valid Markdown, and requests are tracked in logs. **AI prompt:** ```text Draft a short llms.txt for {site}: a title, a one-paragraph summary and a sectioned list of key page links, noting that it is not a ranking factor. ``` **Sources:** , , ### Keep llms.txt a curated list, not a sitemap copy Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Content. **Why it matters:** An llms.txt with thousands of URLs defeats its purpose. Its value is pointing to the most important, current resources with short descriptions. **How to do it:** 1. Pick no more than a few dozen key pages. 2. Add a one-sentence description to each link. 3. Update the file as content changes and include a date. **How to verify:** Every link in llms.txt returns 200 and has a short description. **AI prompt:** ```text Review https://{site}/llms.txt for link status, description quality, freshness and structure, and propose an improved version. ``` **Sources:** ### Consider llms-full.txt for documentation sites Priority: Low priority. Effort: A few days. Evidence: Experimental. Roles: Developer. **Why it matters:** llms-full.txt serves all documentation in one Markdown file, making it easy for coding assistants to load into context at once. Its value for content sites is unclear. **How to do it:** 1. Use it only if you have API or product documentation. 2. Generate the file automatically in the build. 3. Keep the size reasonable and split it if needed. **How to verify:** If present, https://{site}/llms-full.txt returns 200 and matches current documentation. **AI prompt:** ```text Suggest a way to generate llms-full.txt automatically from {site} documentation in the build, and explain when it is unnecessary. ``` **Sources:** ### Publish Markdown versions of key pages Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Markdown versions strip menus, ads and scripts so agents get only the content, with fewer tokens and more accurate reading. They are especially useful for docs and help pages. **How to do it:** 1. Generate versions of key pages at the same URL with .md appended. 2. Build them from the same data source as the HTML. 3. Point to them from the HTML with \. **How to verify:** curl -s https://{site}/sample-page.md returns clean Markdown content. **AI prompt:** ```text Suggest a method that fits the stack to auto-generate Markdown versions of key {site} pages, and show a sample conversion output. ``` **Sources:** , ### Return Markdown for Accept: text/markdown requests Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Some agents and CDNs request Markdown through content negotiation. Serving Markdown from the same URL gives agents clean content without a separate address. **How to do it:** 1. Add a layer that detects Accept: text/markdown and returns Markdown. 2. Send Content-Type: text/markdown and Vary: Accept. 3. Test that normal browser requests still get HTML. **How to verify:** curl -s -H "Accept: text/markdown" https://{site}/ returns Markdown with a Vary: Accept header. **AI prompt:** ```text Explain ways to implement Accept: text/markdown content negotiation for {site} on the server or CDN, and why the Vary header is needed for caching. ``` **Sources:** ### Advertise alternate versions and discovery files with HTTP Link headers Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** RFC 8288 Link headers let agents find the Markdown version, API catalog or other resources without parsing HTML. **How to do it:** 1. Add Link: \<...md\>; rel="alternate"; type="text/markdown" to responses. 2. If you have an API, advertise /.well-known/api-catalog with rel="api-catalog". 3. Test that the headers use valid syntax. **How to verify:** curl -sI https://{site}/ shows a Link header. **AI prompt:** ```text Suggest HTTP Link headers for the homepage and content pages of {site} (alternate Markdown, api-catalog, sitemap) and write a sample server configuration. ``` **Sources:** ### Build forms and buttons with accessible names and proper HTML elements Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Agentic browsers understand pages largely through the accessibility tree. Unlabeled fields and div-based buttons leave the agent unsure what to click. **How to do it:** 1. Give every form field a \ or aria-label. 2. Use \ and \ for clickable elements. 3. Add meaningful accessible names to icon buttons. 4. Test that the whole flow works by keyboard. **How to verify:** Lighthouse Accessibility passes “Buttons have an accessible name” and “Form elements have associated labels”. **AI prompt:** ```text Audit the accessible names of buttons and form fields in {site} core flows (search, add to cart, contact form), list elements agentic browsers would not understand and propose corrected HTML. ``` **Sources:** ### Run the Lighthouse “Agentic browsing” audit Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** The experimental Agentic browsing category, added in Lighthouse 13.3 (May 2026), checks the accessibility tree, layout shift (CLS), WebMCP registration and llms.txt at the domain root. It reports passed checks rather than a 0–100 score. **How to do it:** 1. Run the audit on key templates with Chrome DevTools or the Lighthouse CLI. 2. Prioritize failing audits. 3. Add the results to pre-release tests. **How to verify:** The Lighthouse report shows no critical failures in the Agentic browsing section. **AI prompt:** ```text Explain which checks the Lighthouse Agentic browsing audit includes for {site} and create a checklist for prioritizing its results. ``` **Sources:** ### Move information from PDF catalogs and price lists into HTML pages Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Content. **Why it matters:** Tables and specs inside PDFs are hard for agents to parse and are rarely updated. An HTML version of the same information is both readable and maintainable. **How to do it:** 1. List key PDF catalogs, brochures and price lists. 2. Move critical information into HTML pages and tables. 3. Keep the PDF as a download option. **How to verify:** Product and price information from key PDFs is also available on HTML pages. **AI prompt:** ```text Suggest a method to find PDF files on {site} and prioritize which content should move to HTML. ``` ### Give specifications as tables or definition lists Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Content. **Why it matters:** When comparing, agents look for values such as size, weight, compatibility or limits. Specs buried in paragraphs are easily missed or misread. **How to do it:** 1. Create a spec table per product or plan. 2. Write units and values separately and consistently. 3. Use the same attribute names across products. **How to verify:** Product pages contain a spec list in \ or \ in the raw HTML. **AI prompt:** ```text Convert the specs on this {site} product page into a consistent HTML table agents can compare: [URL]. ``` ### Keep contact, returns, shipping, privacy and terms pages easy to find and plain Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, Content. **Why it matters:** Agents check return windows, shipping costs and contact details before buying. If these pages are missing or vague, the agent may pick another seller. **How to do it:** 1. Link them from the footer. 2. State periods, fees and conditions as numbers and bullets. 3. Serve them as HTML text. **How to verify:** The footer links to returns, shipping, privacy, terms and contact pages, all returning 200. **AI prompt:** ```text Assess the {site} returns, shipping, privacy and contact pages for the information an agent needs to make a purchase decision, and list missing or vague points. ``` ### Use AGENTS.md for your code repositories, not your website Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer. **Why it matters:** AGENTS.md tells coding agents how to work in a repository and sits under the Agentic AI Foundation. Publishing it at a website root has no known effect on search or agent visibility. **How to do it:** 1. Add AGENTS.md if you have SDK, sample code or open-source repos. 2. Keep setup, test and contribution rules short. 3. Do not spend time producing a separate AGENTS.md for the website. **How to verify:** Your public code repositories have a current AGENTS.md at the root. **AI prompt:** ```text Draft a short AGENTS.md for an SDK or sample code repository published by {site}: setup, tests, code style and caveats. ``` **Sources:** ## API and capability discovery Agents do not just read pages; they find APIs, MCP servers and authorization endpoints to take action. This section covers making your capabilities machine-discoverable and safely usable. ### Publish an annotated OpenAPI description for your public API Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Agents and agent-building tools learn an API from its OpenAPI description. The clearer the endpoint and parameter descriptions, the more likely the agent makes the right call. **How to do it:** 1. Generate an OpenAPI 3.x description automatically and publish it at a stable URL. 2. Add descriptions and examples for every operation, parameter and error. 3. Define authentication with securitySchemes. **How to verify:** https://{site}/openapi.json (or the documented URL) returns 200 and validates without errors. **AI prompt:** ```text Review the {site} OpenAPI description for agent usability: clarity of descriptions, examples, error responses and auth definitions; rank improvement suggestions. ``` **Sources:** ### List your APIs at /.well-known/api-catalog Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** RFC 9727 defines listing a domain’s APIs and their description documents at a standard address, so agents reach API descriptions without guessing. **How to do it:** 1. Publish a catalog at /.well-known/api-catalog as application/linkset+json. 2. Add service-desc (OpenAPI) and service-doc (documentation) links per API. 3. Advertise it from the homepage with a Link: rel="api-catalog" header. **How to verify:** curl -s https://{site}/.well-known/api-catalog returns valid linkset JSON. **AI prompt:** ```text Write an RFC 9727 compliant /.well-known/api-catalog file for {site} with service-desc, service-doc and status links for each API. ``` **Sources:** ### Publish OAuth authorization server and protected resource metadata Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Agents acting for users must discover authorization endpoints to get access. RFC 8414 and RFC 9728 standardize this discovery, and MCP authorization builds on them. **How to do it:** 1. Publish /.well-known/oauth-authorization-server (or OpenID Connect discovery). 2. Publish /.well-known/oauth-protected-resource metadata for the API. 3. Point to the metadata via WWW-Authenticate in 401 responses. **How to verify:** curl -s https://{site}/.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource return valid JSON. **AI prompt:** ```text Write sample RFC 8414 authorization server metadata and RFC 9728 protected resource metadata for the {site} API, and explain how MCP clients use them. ``` **Sources:** , , ### Consider offering a remote MCP server for core actions Priority: High priority. Effort: Project. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** Model Context Protocol has become the dominant protocol for connecting agents to tools and was donated to the Linux Foundation’s Agentic AI Foundation. Exposing capabilities such as product search, order status or account actions via MCP lets agents use them directly. **How to do it:** 1. Pick the 3–5 actions agents will need most. 2. Design them as clearly named, well-described MCP tools. 3. Protect the remote (HTTP) MCP server with OAuth. 4. Advertise the server in docs and discovery files. **How to verify:** An MCP client (e.g. MCP Inspector) can connect and list the tools with their descriptions. **AI prompt:** ```text Design 5 tools {site} could offer on a remote MCP server: name, description, input schema, output and required authorization scope. ``` **Sources:** , ### Apply least privilege to MCP and API access Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agents act on users’ behalf and can be steered by wrong or malicious instructions. Narrow permissions limit the possible damage. **How to do it:** 1. Define separate scopes for read and write operations. 2. Use short-lived access tokens. 3. Require extra confirmation for high-risk actions like payments or deletion. **How to verify:** The authorization document lists the required scope and risk level for every MCP tool. **AI prompt:** ```text Propose a scope design for the {site} MCP server or API: a table separating read, write and high-risk actions, and when extra confirmation is required. ``` **Sources:** ### If you run an MCP server, track the draft MCP Server Card discovery proposal Priority: Low priority. Effort: Quick win. Evidence: Experimental. Roles: Developer. **Why it matters:** MCP Server Card proposals (SEP-1649, continued in SEP-2127) aim to expose a server’s address, capabilities and auth details under /.well-known. The path is not settled: drafts use /.well-known/mcp/server-card.json or server-cards.json, and some guides use /.well-known/mcp.json. None is part of the MCP spec yet. **How to do it:** 1. If you have an MCP server, publish a card following the latest open draft. 2. Include the server URL, transport and authorization details. 3. Recheck the path and fields once the proposal is accepted. **How to verify:** The card URL you chose (e.g. https://{site}/.well-known/mcp/server-card.json) returns valid JSON, and the server URL in it works. **AI prompt:** ```text Summarize the current MCP Server Card drafts (SEP-1649, SEP-2127) for the {site} MCP server, write a sample card, and explain the risks while the path and fields are not final. ``` **Sources:** , ### Decide on a ChatGPT app (Apps SDK); skip legacy GPT Actions Priority: Low priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** OpenAI’s plugin and GPT Actions approach has given way to the MCP-based Apps SDK. A branded experience inside ChatGPT can make sense for high-volume, repeat use cases. **How to do it:** 1. Define what users would want to do with you inside ChatGPT. 2. Consider reusing your MCP server with the Apps SDK. 3. Check app review and publishing requirements. **How to verify:** The ChatGPT app decision, scope and rationale are documented. **AI prompt:** ```text Help me decide whether building a ChatGPT app (Apps SDK) makes sense for {site}: use cases, required tools, effort and expected benefit. ``` ### Consider publishing Agent Skills (SKILL.md) packages Priority: Low priority. Effort: A few days. Evidence: Experimental. Roles: Developer. **Why it matters:** Agent Skills is an open, SKILL.md-based format that tells agents how to do a specific task. If using your product involves repeat workflows, publishing them as skills helps agents use it correctly. **How to do it:** 1. List repeat tasks performed with your product. 2. Write a short SKILL.md and any scripts for each. 3. Announce the packages in docs or a code repository. **How to verify:** Each published skill’s SKILL.md works with the current API. **AI prompt:** ```text Suggest 3 Agent Skills that could be written for agents using {site}, and draft the SKILL.md for one. ``` **Sources:** ### If you run your own agent, describe it with an A2A Agent Card Priority: Low priority. Effort: A few days. Evidence: Experimental. Roles: Developer. **Why it matters:** The Agent2Agent (A2A) protocol lets agents discover each other and delegate tasks, and UCP has added A2A support. An Agent Card advertises your agent’s skills and endpoint in a standard format. **How to do it:** 1. If you run a support or sales agent, consider A2A support. 2. Publish the Agent Card at /.well-known/agent-card.json. 3. Keep authorization and skill definitions current. **How to verify:** The Agent Card URL returns valid JSON and the declared endpoint responds. **AI prompt:** ```text Explain the requirements for exposing a {site} customer service agent via A2A and draft a sample Agent Card. ``` **Sources:** ### Track WebMCP but do not prioritize investment yet Priority: Low priority. Effort: Quick win. Evidence: Experimental. Roles: Developer. **Why it matters:** WebMCP is a proposal that lets web pages expose tools to in-browser agents; Chrome offers it through an origin trial, and it appears in the experimental Lighthouse Agentic browsing audits. Adoption is still very low. **How to do it:** 1. Check the proposal and browser support quarterly. 2. Plan a small trial if agentic browser traffic grows. **How to verify:** Technology watch notes show the WebMCP status updated in the last quarter. **AI prompt:** ```text Briefly summarize what WebMCP is, which scenarios it could help with on {site}, and its current adoption. ``` **Sources:** , ### Return API errors and rate limits in machine-readable form Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Agents read error messages to correct themselves. RFC 9457 problem details and rate-limit headers tell the agent what went wrong and when to retry. **How to do it:** 1. Return errors as application/problem+json with type, title and detail. 2. Use 429, Retry-After and remaining-quota headers for rate limits. 3. List error codes in the documentation. **How to verify:** A malformed API request returns application/problem+json with a descriptive detail field. **AI prompt:** ```text Assess the {site} API’s error responses from an agent’s point of view, and propose RFC 9457 compliant error examples and rate-limit headers. ``` **Sources:** ### Offer a sandbox for agent developers Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agent integrations should be tested without creating real orders or payments. A sandbox catches integration bugs before production. **How to do it:** 1. Provide a test environment and test keys that never touch real data. 2. Add test payment methods and sample products. 3. Document the differences between sandbox and production. **How to verify:** Documentation includes the sandbox URL and steps to get a test key. **AI prompt:** ```text List the requirements for a {site} sandbox suitable for testing agent integrations: test data, payment simulation, rate limits and resets. ``` ### Configure CORS deliberately for public read endpoints Priority: Low priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Agents and tools running in the browser cannot call APIs without CORS permission. Controlled access helps for public, unauthenticated read endpoints. **How to do it:** 1. Identify public read endpoints. 2. Set an appropriate Access-Control-Allow-Origin for them. 3. Do not grant broad CORS on authenticated endpoints. **How to verify:** curl -sI -H "Origin: https://example.com" https://{site}/api/... returns correct CORS headers on public endpoints. **AI prompt:** ```text Write a recommended CORS policy for public and protected endpoints of the {site} API and explain the security risks. ``` **Sources:** ## Machine-readable product pages Shopping agents compare products on price, stock, shipping, returns and specs. Having this information both visible and structured on the product page is a precondition for being considered. ### Use complete Product markup on every product page Priority: High priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Product data tells machines the product name, brand, images, description and identifiers. Google shopping surfaces and the AI Mode shopping experience draw on it. **How to do it:** 1. Add Product JSON-LD to product pages. 2. Fill in name, image, description, brand, sku and gtin. 3. Link price and stock via offers. **How to verify:** The Rich Results Test detects valid Product and merchant listing data on the product page. **AI prompt:** ```text Write complete Product JSON-LD for this {site} product page (including brand, gtin, image and offers) and list gaps in the current markup: [URL]. ``` **Sources:** , ### Give price in local currency with tax and accurate stock in Offer markup Priority: High priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Agents read price and stock straight from Offer data. Consumer prices in Turkey must include KDV (VAT), and the marked-up price must match the page. **How to do it:** 1. Fill in price, priceCurrency (e.g. TRY) and availability. 2. Model sale prices correctly with priceSpecification. 3. Generate price and stock in real time from the same source as the page. **How to verify:** The product page JSON-LD has the correct priceCurrency, a price equal to the tax-inclusive price on the page, and availability matching real stock. **AI prompt:** ```text Check the Offer markup on this {site} product page for price (currency, tax-inclusive), discount, stock and validity, and write corrected JSON-LD: [URL]. ``` **Sources:** , ### Make shipping cost and delivery time machine-readable Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Conditions like “next-day delivery” or “free shipping” are among agents’ selection criteria. OfferShippingDetails or Merchant Center shipping settings structure this information. **How to do it:** 1. Define shipping cost, free shipping threshold and delivery time. 2. Set them in OfferShippingDetails or Merchant Center shipping settings. 3. Check consistency with the shipping text on the page. **How to verify:** The Rich Results Test or Merchant Center shows shipping data without errors. **AI prompt:** ```text Write a sample OfferShippingDetails JSON-LD for {site} domestic shipping: cost, free shipping threshold, handling and transit time. ``` **Sources:** , ### Structure your return policy with MerchantReturnPolicy Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Return window and cost are among the details agents check when choosing between sellers. A MerchantReturnPolicy at the Organization level can apply to all products. **How to do it:** 1. Define return window, method and fees. 2. Add MerchantReturnPolicy at the Organization or Offer level. 3. Reflect legal minimums such as the 14-day withdrawal right in Turkey and the EU. **How to verify:** The Rich Results Test or Merchant Center detects the return policy without errors. **AI prompt:** ```text Write an Organization-level MerchantReturnPolicy JSON-LD example for {site} with return window, method, fees and country, respecting statutory withdrawal rights. ``` **Sources:** , ### Provide complete GTIN (barcode), MPN and brand data Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer, Business. **Why it matters:** Agents use GTINs to match the same product across sellers. Products without identifiers may be left out of comparisons. **How to do it:** 1. Add a valid GTIN to every product. 2. Use brand and mpn where no GTIN exists. 3. Keep identifiers identical in structured data and the feed. **How to verify:** At least 95% of products have a gtin or brand+mpn. **AI prompt:** ```text Suggest a method to measure GTIN, MPN and brand coverage in the {site} catalog and explain ways to fill missing identifiers. ``` **Sources:** , ### Model size, color and other variants with ProductGroup Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** If variants are not grouped correctly, an agent may miss the size in stock or treat each variant as a separate product. **How to do it:** 1. Define the parent product as ProductGroup and variants via hasVariant. 2. Specify the varying attributes with variesBy (size, color). 3. Give each variant its own price, stock and identifier. **How to verify:** The Rich Results Test detects ProductGroup and its variants on a variant product page. **AI prompt:** ```text Write JSON-LD with ProductGroup and hasVariant for this {site} product with variants: [URL]. ``` **Sources:** ### Use selectable variant URLs and consistent canonicals Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** For an agent to send a user straight to the right size or color, each variant needs a reachable URL. A consistent canonical decision prevents duplicate signals. **How to do it:** 1. Make each variant addressable with a parameter like ?color=... or its own path. 2. Decide whether variants canonicalize to themselves or the parent, and apply it consistently. 3. Test that a variant URL opens with the right option selected. **How to verify:** Opening a variant URL preselects the right option, and the canonical policy is consistent. **AI prompt:** ```text Review the variant URL structure and canonical usage on {site} and suggest how agents can link to the right variant. ``` **Sources:** ### Generate rating and review markup only from real, visible reviews Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Business, Developer. **Why it matters:** AggregateRating and Review feed agents’ quality comparisons. Ratings not shown on the page, cherry-picked, or self-published about your own business violate guidelines. **How to do it:** 1. Compute ratings automatically from real customer reviews. 2. Keep reviews visible on the product page. 3. Do not mark up your own reviews of your Organization or LocalBusiness on your own site. **How to verify:** ratingValue and reviewCount in JSON-LD match the values shown on the page. **AI prompt:** ```text Audit AggregateRating and Review markup on {site} product pages for compliance with Google’s guidelines and list risky uses. ``` **Sources:** , ### Write original, concrete, fact-based product descriptions Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Content. **Why it matters:** Descriptions copied from the manufacturer are identical across hundreds of sites. Concrete details such as material, dimensions, use and care let an agent answer “is this right for me?”. **How to do it:** 1. Write original descriptions for priority products. 2. Use measurable attributes instead of marketing adjectives. 3. Add answers to common product questions. **How to verify:** Descriptions of priority products differ from manufacturer copy and contain concrete attributes. **AI prompt:** ```text Rewrite the description of this {site} product so it is fact-based, original and comparable by agents: [URL]. ``` ### State clearly who the product is and is not for Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Content. **Why it matters:** Agents match user needs to products. Clear compatibility, use cases and limitations lead to better matches and fewer returns. **How to do it:** 1. State suitable users and scenarios for each product. 2. Write compatibility and limitations (e.g. “not compatible with iPhone 15”). 3. Show differences from similar products in a short comparison. **How to verify:** Priority product pages have a “who it is for” and limitations section. **AI prompt:** ```text Write a “who it is for, who it is not for, what it works with” section for this {site} product: [URL]. ``` ### Provide high-resolution, clean, multi-angle product images Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Content. **Why it matters:** Shopping surfaces and vision-capable models recognize products from images. Images with watermarks, text or busy collages may be rejected or misread. **How to do it:** 1. Use a clean-background main image with no text, borders or watermarks, at least 500x500 pixels (about 1500x1500 recommended). 2. Add multiple angles and in-use images. 3. Do not use watermarked or promotional images as the main image. **How to verify:** Merchant Center shows no image-related product disapprovals. **AI prompt:** ```text Create a checklist to assess {site} product images for shopping surfaces and agents: resolution, background, number of angles, watermarks and alt text. ``` **Sources:** ### If you sell abroad, state delivery regions, currency and customs terms clearly Priority: Low priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** An agent cannot recommend you without knowing whether you ship to the user’s country and the total cost. Unclear terms cause cart abandonment. **How to do it:** 1. Declare shipping countries with shippingDestination. 2. Show currency and tax status per market. 3. State who bears customs and taxes (DDP or DAP). **How to verify:** Cross-border product pages show price, shipping and tax by destination, matching the markup. **AI prompt:** ```text Explain how {site} should present cross-border terms (delivery regions, currency, customs, tax) on the page and in structured data so agents understand them. ``` ## Product feeds Shopping agents and AI shopping surfaces mostly take product data from feeds rather than crawling pages. Feed quality, freshness and consistency with your site determine visibility in these channels. ### Publish a current product feed in Google Merchant Center Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Business, Developer. **Why it matters:** Google’s Shopping Graph, free product listings and the AI Mode shopping experience use Merchant Center data. AI Mode’s launch in more markets, including Turkey, makes this data even more important. **How to do it:** 1. Open a Merchant Center account and verify your domain. 2. Set up a product feed or Merchant API connection. 3. Enable free listings. **How to verify:** Merchant Center \> Products shows most products as “Approved”. **AI prompt:** ```text Create a step-by-step checklist for setting up Google Merchant Center and free listings for {site}, and explain how it relates to AI Mode shopping visibility. ``` **Sources:** ### Fill every required feed field Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Missing id, title, description, link, image\_link, price or availability fields get products rejected or dropped from agent comparisons. **How to do it:** 1. Check each platform’s required field list. 2. Fill gaps in the source system. 3. Add recommended fields too (brand, gtin, color, size). **How to verify:** Merchant Center Diagnostics shows no missing required field errors. **AI prompt:** ```text Create a checklist table to audit the {site} product feed against Google Merchant Center and ChatGPT product feed required fields. ``` **Sources:** , ### Keep product IDs stable and unique Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Changing product IDs reset performance history, review matching and agents’ ability to track products. **How to do it:** 1. Use an unchanging id per product and variant (e.g. SKU). 2. Keep old IDs through platform migrations. 3. Check no id is shared by two products. **How to verify:** The feed has no duplicate IDs and no ID changes in the last 90 days. **AI prompt:** ```text Suggest a script or method to audit ID consistency in the {site} product feed, detecting duplicate and changed IDs. ``` ### Give accurate, current availability values in the feed Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** An agent that recommends an out-of-stock product loses the user’s trust, and platforms penalize inconsistent stock data. **How to do it:** 1. Use in\_stock, out\_of\_stock, preorder and backorder correctly. 2. Add availability\_date for preorders. 3. Update the feed as soon as stock changes. **How to verify:** For 20 random products, feed availability matches the site. **AI prompt:** ```text Design a sampling check to detect stock mismatches between the feed and the site for {site}. ``` **Sources:** ### Consider submitting a product feed for ChatGPT shopping Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** OpenAI publishes a separate product feed spec for product discovery in ChatGPT. The is\_eligible\_search and is\_eligible\_checkout flags decide whether a product can be used in search and purchase. **How to do it:** 1. Check whether the ChatGPT merchant program is open in your market. 2. Build the feed with the required fields in the OpenAI spec. 3. Set the search and checkout eligibility flags deliberately. **How to verify:** If applied or submitted, products show without errors in the OpenAI merchant dashboard. **AI prompt:** ```text Create a field mapping table to convert the {site} product feed to the OpenAI product feed spec (item_id, title, description, url, brand, seller_name, image_url, availability, price, eligibility flags). ``` **Sources:** ### Include privacy, terms and return policy links in the feed Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** OpenAI’s product feed spec requires the seller’s privacy policy and terms URLs for checkout-eligible products, and return policy and return window details are also used in comparisons. **How to do it:** 1. Add privacy policy and terms URLs to the feed. 2. Fill return policy URL, accepts-returns and return window fields. 3. Check that the URLs return 200. **How to verify:** A feed sample has filled, reachable seller\_privacy\_policy, seller\_tos and return\_policy fields. **AI prompt:** ```text List the policy fields to add to the {site} feed (privacy, terms, return URL, return window) and assess whether the current policy pages are enough for agents. ``` **Sources:** ### Assign the right Google product category and your own product type Priority: Low priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** The right category decides which queries and comparisons a product competes in, and also affects tax and policy rules. **How to do it:** 1. Fill google\_product\_category with the most specific category. 2. Provide your own category path in product\_type. 3. Fix misclassified products. **How to verify:** Merchant Center shows no category warnings, and sample products are categorized correctly. **AI prompt:** ```text Help me build a table mapping {site} product categories to the Google product taxonomy and point out the categories most often gotten wrong. ``` **Sources:** , ### Fill shipping cost and delivery time fields in the feed Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Total cost and delivery time directly affect agents’ ranking of offers. Missing shipping data puts a product at a disadvantage. **How to do it:** 1. Define shipping costs at account or product level. 2. Enter handling and transit times. 3. State the free shipping threshold. **How to verify:** Merchant Center shows no missing shipping warnings and displays an estimated delivery time. **AI prompt:** ```text Explain how to define shipping cost, free shipping threshold and delivery time for {site} in the feed and Merchant Center settings. ``` **Sources:** ### Share product ratings via the feed and product ratings programs Priority: Low priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Product ratings feed agents’ quality comparisons. Keeping reviews only on your site limits how far that information travels. **How to do it:** 1. Join the Merchant Center product ratings program or connect a review provider. 2. Send review data regularly. 3. Make sure reviews are genuine and verified. **How to verify:** The Merchant Center product ratings program is active with current data. **AI prompt:** ```text Explain the steps and requirements for sending {site} product reviews to the Merchant Center product ratings program. ``` ### Serve the feed in UTF-8 and compressed if large Priority: Low priority. Effort: Quick win. Evidence: Official source. Roles: Developer. **Why it matters:** Wrong encoding breaks non-ASCII letters and makes product names unsearchable. Compression reduces transfer errors for large feeds. **How to do it:** 1. Generate the feed as UTF-8. 2. Gzip large files. 3. Spot-check product names for special characters. **How to verify:** Random feed rows show special characters intact. **AI prompt:** ```text Write commands to check the encoding and format of the {site} product feed and suggest a method to detect garbled characters. ``` ### Push the feed via API instead of scheduled fetches Priority: Medium priority. Effort: Project. Evidence: Emerging standard. Roles: Developer. **Why it matters:** A feed fetched once a day misses intraday price and stock changes. Pushing changes immediately via the Merchant API or platform APIs improves consistency. **How to do it:** 1. Capture price and stock changes as events. 2. Push changed products via API right away. 3. Keep sending the full feed daily as a backup. **How to verify:** After a price change, the product’s price in Merchant Center updates shortly afterwards. **AI prompt:** ```text Propose an architecture for {site} that pushes price and stock changes to the Merchant API in real time, covering event sources, queueing and error handling. ``` ### Keep price and stock data fresh within minutes Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agents expect current price and stock at decision time. Delayed updates around promotion start and end times lead to wrong prices and disapprovals. **How to do it:** 1. Set a target latency for price and stock updates. 2. Schedule promotion starts and ends in advance. 3. Monitor latency and alert when it exceeds the threshold. **How to verify:** Price and stock update latency to feeds is measured and below target. **AI prompt:** ```text Design a way to measure how long price and stock changes take to reach feeds for {site}, and suggest reasonable targets. ``` ### Keep price and stock consistent across feed, structured data and page Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Developer. **Why it matters:** Platforms compare feed prices with the landing page; mismatches lead to disapprovals and lost agent trust. **How to do it:** 1. Feed all three from the same data source. 2. Compare them regularly by sampling. 3. Track mismatch warnings in Merchant Center. **How to verify:** Merchant Center shows no “price mismatch” or “availability mismatch” warnings. **AI prompt:** ```text Design a sampling script for {site} that checks price and stock consistency between the feed, JSON-LD and the visible page. ``` ### Keep the feed error rate low and review diagnostics regularly Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Developer, Business. **Why it matters:** Disapproved or warned products are the part of your catalog agents cannot see. Errors accumulate and quietly reduce visibility. **How to do it:** 1. Review Merchant Center Diagnostics weekly. 2. Prioritize errors by type and fix them at the source. 3. Set a target for the disapproved rate (e.g. under 2%). **How to verify:** The disapproved product rate is below target. **AI prompt:** ```text Create a weekly routine for {site} to prioritize errors and warnings in the Merchant Center diagnostics report. ``` ### Use separate feeds per market with the right language, currency and shipping Priority: Low priority. Effort: A few days. Evidence: Official source. Roles: Developer, Business. **Why it matters:** Sending one feed to every country shows the wrong language, currency or shipping information. **How to do it:** 1. Define target country and language combinations. 2. Create a feed for each with local currency, language and shipping. 3. Use country-specific landing page URLs. **How to verify:** Merchant Center has a separate data source per target country with the correct language and currency. **AI prompt:** ```text Create a table planning the feed structure for {site} across domestic and foreign markets (language, currency, shipping, landing page). ``` ### Write feed titles and descriptions in edited, natural language Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Content. **Why it matters:** Machine-translated, all-caps or keyword-stuffed titles violate policies and cause agents to misread products. **How to do it:** 1. Order titles as brand, product type and key attributes. 2. Avoid all caps and promotional phrases. 3. Have native speakers review translated feeds. **How to verify:** 20 random product titles show no all caps, promotional phrases or broken translations. **AI prompt:** ```text Rewrite these {site} feed product titles following best practices for Google and agents: [titles]. ``` ### Screen restricted and prohibited products against policies before sending them Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business. **Why it matters:** Categories such as health, alcohol, supplements or weapons are restricted in platform and agent policies. Non-compliant products can cause account-level problems. **How to do it:** 1. Review platforms’ restricted content policies. 2. Flag or exclude products in restricted categories. 3. Add required certification and age restriction details. **How to verify:** Merchant Center shows no policy violation warnings. **AI prompt:** ```text Create a checklist to identify categories in the {site} catalog that may be restricted under Google and OpenAI shopping policies. ``` **Sources:** ### Automate, version and make feed generation reversible Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Hand-built feeds go wrong and go stale. Quickly rolling back a bad bulk update stops a wrong price from spreading to every channel. **How to do it:** 1. Generate the feed automatically from the product database. 2. Store each build with a version number. 3. Add a rollback procedure and pre-send validation. **How to verify:** Feed versions for the last 30 days are stored and the rollback procedure has been tested. **AI prompt:** ```text Design an automated feed generation, versioning and rollback process for {site}, including pre-submission validation rules. ``` ### Submit your product feed to Microsoft Merchant Center too Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business. **Why it matters:** Copilot and Bing shopping experiences use Microsoft Merchant Center data. Importing your Google feed reaches a second channel with little effort. **How to do it:** 1. Create a store in Microsoft Merchant Center. 2. Import from Google Merchant Center or reuse the same feed. 3. Check disapproved products. **How to verify:** The Microsoft Merchant Center store is approved and products are active. **AI prompt:** ```text Walk me through setting up Microsoft Merchant Center for {site} and importing the Google feed. ``` ## Agentic commerce protocols Protocols such as UCP, ACP and AP2 are evolving so agents can build carts and pay on your behalf. The field moves fast; this section separates what is usable today from what to watch. ### Find out and enable your commerce platform’s agentic support Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Most verified UCP stores run on Shopify, and Shopify agentic storefronts are active by default for eligible stores. If your platform supports it, that is the fastest route. **How to do it:** 1. Check your platform’s UCP, ACP or agentic storefront support. 2. If supported, review and enable the settings. 3. If not, ask about the roadmap and app/plugin options. **How to verify:** The status and decision for agentic commerce settings in the platform admin are recorded. **AI prompt:** ```text List questions and checks to research agentic commerce and UCP support on the {site} commerce platform (e.g. Shopify, WooCommerce, Magento or local platforms). ``` **Sources:** , ### Publish a UCP profile at /.well-known/ucp Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** The Universal Commerce Protocol (Google and Shopify) powers shopping and checkout flows in Google AI Mode and Gemini. The profile tells agents which capabilities and endpoints your store supports. About 8,259 stores were verified in June 2026, and deeper capabilities are still rare. **How to do it:** 1. Check the current UCP spec at ucp.dev. 2. Publish the profile at /.well-known/ucp. 3. Declare supported capabilities (catalog, cart, checkout) realistically. **How to verify:** curl -s https://{site}/.well-known/ucp returns valid JSON and passes a UCP validator. **AI prompt:** ```text Explain which fields the UCP profile for {site} should contain under the current spec, and create a checklist to test that declared capabilities actually work. ``` **Sources:** , ### Validate the UCP profile response, required fields, signing keys and payment handlers Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** The most common UCP errors are a /.well-known/ucp address that returns 404 or HTML instead of JSON, missing ucp.services or ucp.payment\_handlers fields, signing keys in the wrong place and an outdated spec version. At runtime, variant mismatches are the top reason agent purchases fail. **How to do it:** 1. Check that the profile returns JSON and is not blocked by the WAF or robots.txt. 2. Confirm the required fields and that signing keys sit where the current spec expects them. 3. Run an end-to-end test checkout for each payment\_handler and variant. **How to verify:** A UCP validator reports no errors or warnings, and a test checkout completes. **AI prompt:** ```text Write a step-by-step test plan to audit the response, required fields, signing keys, payment_handlers and variant handling of the {site} UCP profile. ``` **Sources:** , ### Decide on ACP knowing its current state: Instant Checkout was pulled back Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** ChatGPT Instant Checkout, built on OpenAI and Stripe’s Agentic Commerce Protocol, launched in September 2025 and was pulled back in March 2026; ACP continues as a backend for discovery and merchant apps. Almost no merchants serve the /.well-known/acp.json discovery file (spec 2026-04-17). **How to do it:** 1. Base any ACP investment on current ChatGPT merchant options. 2. If you use Stripe, check whether ACP support can be enabled cheaply. 3. Publish /.well-known/acp.json per the spec if you support ACP. **How to verify:** The ACP decision and rationale are written in the protocol tracking document; if published, the file returns valid JSON. **AI prompt:** ```text Write a short decision note summarizing the current state of the Agentic Commerce Protocol (ACP), the pullback of Instant Checkout, and whether investing in ACP makes sense for {site}. ``` **Sources:** , ### Decide which merchant and agent checkout programs on AI surfaces to join Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Google (agentic checkout via UCP), ChatGPT merchant apps, Perplexity and Microsoft offer different merchant programs, and their market coverage keeps changing. Choosing deliberately puts effort in the right place. **How to do it:** 1. List programs open in your target markets. 2. Compare requirements, fees and technical effort for each. 3. Apply to priority programs and record the outcome. **How to verify:** A table records participation status, date and rationale per program. **AI prompt:** ```text Create a decision table template for {site} comparing AI shopping and agent checkout programs available in its target markets. ``` ### Run an end-to-end shopping simulation with an agent: search, cart, checkout Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** Even if individual checks pass, the whole flow may not work for an agent. A simulation with a real agent is the fastest way to see the problems users will hit. **How to do it:** 1. Search for a product with an agentic browser or an agent checkout test environment. 2. Choose a variant, add to cart and proceed to checkout. 3. Record where it got stuck, what it misread and how long it took. **How to verify:** The simulation report gives pass/fail for search, variant selection, cart and checkout. **AI prompt:** ```text Write an end-to-end shopping simulation scenario for {site} with an agent: the task prompt, success criteria and observations to record at each step. ``` ### Offer links that take users straight to the right product, variant and cart Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Even if an agent cannot complete the purchase, it can send the user to a pre-filled cart or selected variant, reducing conversion loss. **How to do it:** 1. Support product URLs with variant and quantity. 2. Offer an add-to-cart or pre-filled cart link. 3. Document these links or expose them in MCP tools. **How to verify:** A link with variant and quantity parameters opens the cart with the right selection. **AI prompt:** ```text Design deep link patterns agents can use on {site}: product variant, quantity, coupon and pre-filled cart. ``` ### Expose catalog, cart and order operations as APIs Priority: Medium priority. Effort: Project. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Every agentic protocol needs product, cart, payment and order APIs behind it. An API-first setup lets you add new protocols quickly. **How to do it:** 1. Inventory your platform’s catalog, cart and order APIs. 2. Plan APIs or middleware for missing operations. 3. Protect APIs with authentication and rate limits. **How to verify:** Documented API endpoints exist for catalog, cart creation and order status. **AI prompt:** ```text Create a gap analysis template listing the API capabilities {site} needs to support agentic commerce protocols (catalog, stock, cart, payment, order status, returns). ``` ### Plan to serve multiple protocols through one internal commerce layer Priority: Low priority. Effort: Project. Evidence: Experimental. Roles: Developer. **Why it matters:** UCP, ACP and future protocols ask for similar operations in different shapes. Wiring each protocol straight into the core system multiplies maintenance. **How to do it:** 1. Design an internal interface for shared operations (catalog, cart, payment, order). 2. Implement each protocol as an adapter on that interface. 3. Absorb protocol version changes in the adapters. **How to verify:** The architecture document defines protocol adapters and a shared internal interface. **AI prompt:** ```text Briefly design an adapter architecture for {site} that connects protocols like UCP and ACP to one internal commerce interface, and assess at what stage it becomes necessary. ``` ### Track AP2 and agent payment authorization standards Priority: Low priority. Effort: Quick win. Evidence: Experimental. Roles: Business. **Why it matters:** Google donated the Agent Payments Protocol (AP2) to the FIDO Alliance in April 2026; version 0.2, published with the transfer, adds “Human Not Present” payments within instructions the user approved in advance. Cryptographic proof of user consent may become a core requirement for agent payments. **How to do it:** 1. Ask your payment provider about AP2 or similar authorization plans. 2. Follow FIDO Alliance announcements quarterly. 3. Consider pilot opportunities. **How to verify:** The protocol tracking document shows the AP2 status updated in the last quarter. **AI prompt:** ```text Write a short summary of what the Agent Payments Protocol (AP2) is, what its donation to the FIDO Alliance means, and what a merchant like {site} should do today. ``` **Sources:** ### Track x402 and machine payment protocols Priority: Low priority. Effort: Quick win. Evidence: Experimental. Roles: Developer. **Why it matters:** Protocols such as x402 (built on HTTP 402) and MPP aim to let agents make small payments for API and content access. If you sell API or content access, they may become a revenue model; adoption today is limited. **How to do it:** 1. Assess whether you have a paid API or content scenario. 2. Track the x402 and MPP specs and payment provider support. 3. Plan a small pilot if it fits. **How to verify:** Technology watch notes include an assessment of x402 and MPP. **AI prompt:** ```text Summarize agent payment approaches such as x402 and the Machine Payments Protocol (MPP), and assess in which scenarios they could make sense for {site}. ``` **Sources:** , ### Assign an owner and schedule to track protocol changes Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** UCP, ACP, MCP and AP2 change versions every few months, and features like Instant Checkout come and go. Untracked changes silently break integrations. **How to do it:** 1. Assign a tracking owner per protocol. 2. Check release notes monthly. 3. Tie breaking changes to the test and release plan. **How to verify:** The protocol tracking table lists owner, current version and last check date for each protocol. **AI prompt:** ```text Create a tracking table template for {site} covering UCP, ACP, MCP, AP2 and A2A: owner, current version, last check, affected systems and actions. ``` ## Payments, commercial terms and unit economics Sales through agents can have different economics: commissions, payment liability and return costs. This section covers the commercial decisions needed for the channel to be profitable and safe. ### Clarify who is merchant of record for sales through agents Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Merchant of record determines who carries tax, invoicing, returns and consumer law responsibilities. The role can differ by protocol and platform. **How to do it:** 1. Check the merchant of record in the contract for each program you join. 2. Plan invoicing and tax responsibilities accordingly. 3. Document the decision with legal and accounting. **How to verify:** A written document states the merchant of record and responsibilities for each agent channel. **AI prompt:** ```text Create a checklist for {site} to assess who will be merchant of record in agent channels (Google UCP, ChatGPT merchant apps, etc.) and how that affects invoicing, tax and returns. ``` ### Model agent channel commissions and fees against margin Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** Platform commissions, payment fees and potential ad costs together can make some product sales unprofitable. **How to do it:** 1. Collect each channel’s commission and fee structure. 2. Calculate contribution margin by product category. 3. Identify loss-making combinations. **How to verify:** A contribution margin table by channel and category is current. **AI prompt:** ```text Create a contribution margin model template for {site} covering commissions, payment fees and return costs in agent channels. ``` ### Choose which products to open to agent channels by profitability and fit Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Opening the whole catalog at once lets agents sell low-margin, fragile or high-return products too. **How to do it:** 1. Identify products with good margin, reliable stock and low returns. 2. Start with these in the first phase. 3. Expand scope based on results. **How to verify:** The list of products open to agent channels and the selection criteria are documented. **AI prompt:** ```text Propose a scoring model based on margin, stock reliability, return rate and product data quality to choose which {site} products to open to agent channels first. ``` ### Test the agent payment flow (shared or delegated payment tokens) end to end Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agent payments usually use tokens limited in scope and amount instead of card details. You need to see how your payment provider handles this before going live. **How to do it:** 1. Learn your payment provider’s agent payment support and test environment. 2. Test successful, declined and cancelled payment scenarios. 3. Check how extra authentication such as 3D Secure affects the flow. **How to verify:** The test report documents successful, declined and refunded agent payment scenarios. **AI prompt:** ```text Create a list of scenarios to test agent-initiated payments on {site}: successful payment, limit exceeded, 3D Secure, cancellation, partial refund and full refund. ``` ### Clarify chargeback and fraud liability for agent orders Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** “I did not order this” disputes are a new risk area for agent orders. Whether liability sits with the merchant, platform or payment provider depends on the contract. **How to do it:** 1. Read each channel’s chargeback and fraud policy. 2. Flag agent orders and track their dispute rate. 3. Keep evidence of user consent. **How to verify:** Chargeback rate for agent orders is reported separately and liability is documented. **AI prompt:** ```text List the evidence retention, consent and monitoring measures {site} can use to reduce chargeback risk on agent orders. ``` ### Support local payment habits (installments, local card schemes) in agent flows Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Installment payments and local card schemes are common in markets like Turkey. If the agent payment flow only supports single charges, users may not complete the purchase. **How to do it:** 1. List the most used payment methods in target markets. 2. Check whether your agent payment provider supports them. 3. Offer a fallback flow completed on your site for unsupported methods. **How to verify:** A table lists target market payment methods and their support in agent channels. **AI prompt:** ```text Create a checklist for {site} to assess support for common local payment methods (installments, local card schemes, wallets) in agent payment flows. ``` ### Run multi-currency pricing consistently and manage FX risk Priority: Low priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Agents compare prices for users in different countries. Inconsistent conversion or rounding causes price mismatches and margin loss. **How to do it:** 1. Set the currency and rounding rule per market. 2. Define the exchange rate source and update frequency. 3. Show the same price in the feed, page and checkout. **How to verify:** The same product’s price in each market is consistent across feed, page and checkout. **AI prompt:** ```text Draft a multi-currency pricing policy for {site}: currencies, rate source, update frequency, rounding and FX risk measures. ``` ### Calculate and invoice tax correctly per market Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Business, Developer. **Why it matters:** In Turkey, KDV (VAT) rates vary by product, and e-invoicing (e-Arşiv/e-Fatura) is mandatory for online sellers above the thresholds set by the Revenue Administration (GİB); cross-border sales follow other rules. Agent orders are subject to the same rules. **How to do it:** 1. Define correct tax rates per product. 2. Check that agent orders flow automatically into e-invoicing. 3. Apply destination tax rules for cross-border sales. **How to verify:** A test agent order produces an electronic invoice with the correct tax rate. **AI prompt:** ```text Create a test plan for {site} to confirm that orders from agent channels flow correctly into tax calculation and e-invoicing. ``` **Sources:** ### Show the total price, including shipping, tax and fees, early and clearly Priority: High priority. Effort: Quick win. Evidence: Official source. Roles: Business, Content. **Why it matters:** Agents compare on total cost. Extra fees revealed at checkout can breach consumer rules and cost the agent’s trust. **How to do it:** 1. State shipping and extra fees on the product page. 2. Remove hidden service charges. 3. Fill feed and structured data fields that make up total cost. **How to verify:** In a test order, the total shown on the product page equals the checkout total (excluding user choices). **AI prompt:** ```text Write a test scenario that tracks price changes for a {site} product from the product page to checkout, and list hidden fee risks. ``` ### Model return and cancellation costs for agent orders separately Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** Buying through an agent without inspecting the product can raise return rates. Return logistics and value loss determine channel profitability. **How to do it:** 1. Track return and cancellation rates for agent orders separately. 2. Calculate logistics and value loss per return. 3. Consider removing high-return products from the agent channel. **How to verify:** The channel report includes return rate and return cost for agent orders. **AI prompt:** ```text Build a model for {site} to calculate return costs on agent orders and suggest criteria to identify high-return-risk product categories. ``` ### Set floors and rules for negotiation and dynamic pricing with agents Priority: Low priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Some agents may ask for discounts or trigger automatic discount mechanisms by constantly comparing prices. Unbounded automation erodes margin. **How to do it:** 1. Put price floors on automatic discount and coupon rules. 2. Decide whether you will make agent-specific offers. 3. Log and monitor price changes. **How to verify:** The pricing system defines a price floor per product. **AI prompt:** ```text Draft a dynamic pricing and discount policy for {site} for interactions with agents: floors, coupon rules, cases requiring approval and monitoring. ``` ## Operations, inventory and service reliability Orders through agents need trust after the sale too: accurate stock, realistic delivery, queryable order status and fast intervention. This section covers getting operations ready for agent speed and scale. ### Sync inventory in real time across ERP, warehouse and sales channels Priority: High priority. Effort: Project. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Agents can bring orders from several channels at once. Delayed stock sync leads to selling items you do not have and to cancellations. **How to do it:** 1. Make one system (ERP or WMS) the source of truth for stock. 2. Update stock on sale and return events. 3. Monitor cross-channel sync latency. **How to verify:** Stock change propagation time to all channels is measured and below target. **AI prompt:** ```text Propose a real-time inventory sync architecture across ERP, warehouse and sales channels for {site}, including latency and inconsistency monitoring. ``` ### Use safety stock and reservation rules to prevent overselling Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** With concurrent agent orders, the last unit can be sold more than once. Safety stock and cart reservations reduce the risk. **How to do it:** 1. Define safety stock for fast-selling products. 2. Reserve stock briefly during checkout. 3. Notify automatically and offer alternatives when overselling occurs. **How to verify:** The cancellation rate due to overselling over the last 90 days is tracked and below target. **AI prompt:** ```text Suggest safety stock, reservation time and cancellation handling rules to reduce overselling risk on {site}. ``` ### Base delivery promises on actual performance, without optimism Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Agents relay your delivery promise to users. Broken promises cause complaints and lost trust in later recommendations. **How to do it:** 1. Measure actual delivery times by region and carrier. 2. Update displayed times from that data. 3. Adjust times during promotions and peak periods. **How to verify:** On-time delivery is above target, and displayed times match the last 30 days of actual data. **AI prompt:** ```text Design a monitoring report for {site} comparing displayed delivery times with actual carrier data. ``` ### Expose order status via API and webhooks that agents can query Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Users will ask their assistants “where is my order?” too. Exposing order status through a secure API or MCP tool reduces support load. **How to do it:** 1. Provide an authenticated endpoint for order status queries. 2. Send webhooks on status changes (packed, shipped, delivered). 3. Include the tracking link and estimated delivery date in the response. **How to verify:** For a test order, the order status API returns the right status and a webhook fires on status change. **AI prompt:** ```text Design an order status endpoint agents can use on {site}: authentication, response fields, status values and webhook events. ``` ### Plan capacity for sudden agent-driven order spikes Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** When an assistant features your product, traffic and orders can multiply quickly. If infrastructure or warehouse capacity falls short, the opportunity becomes a crisis. **How to do it:** 1. Measure order capacity with load tests. 2. Prepare a surge plan for warehouse and customer service. 3. Check autoscaling and queueing. **How to verify:** The latest load test shows an acceptable error rate at the target order rate. **AI prompt:** ```text Create a capacity plan for {site} for sudden agent-driven demand: infrastructure load testing, warehouse, shipping and customer service steps. ``` ### Build a kill switch to stop agent channels quickly on price or stock errors Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** A wrong price can be spotted by agents within minutes and turn into bulk orders. Fast channel-level shutdown limits the damage. **How to do it:** 1. Define a switch that stops sales per channel or product. 2. Decide who can use it. 3. Alert automatically on abnormal order velocity and test the mechanism regularly. **How to verify:** The kill switch was tested in the last 6 months and takes effect within minutes. **AI prompt:** ```text Write a kill-switch procedure for {site} to stop agent channels on price or stock errors: triggers, authorized people, steps and communication. ``` ### Prepare customer service for orders placed through agents Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** With agent orders, users may not fully remember what they approved, or the order may have come through a platform. The team must recognize these orders and handle them correctly. **How to do it:** 1. Flag agent orders with a visible tag in the system. 2. Prepare reply templates for common scenarios. 3. Define communication and escalation channels with the platform. **How to verify:** Agent orders are distinguishable in the customer service tool and a process document exists. **AI prompt:** ```text Create a guide for the {site} customer service team on orders placed through agents: recognition, common scenarios, reply templates and escalation. ``` ### Define return address, method and window clearly and machine-readably Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business. **Why it matters:** Agents need clear information to explain and start a return. A vague return process also hurts the purchase decision. **How to do it:** 1. Define the return address, shipping method and fee. 2. Keep this identical on the returns page and in MerchantReturnPolicy. 3. Make returns startable online and, if possible, via API. **How to verify:** Return terms on the returns page, structured data and feed are identical. **AI prompt:** ```text Simplify the {site} return process so agents can explain it correctly: address, method, window, fee and online initiation steps. ``` ### Monitor the API and MCP endpoints agents use and set service targets Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** When an agent checkout, catalog or MCP endpoint fails, sales stop silently; the user only sees the agent say it could not complete the task. **How to do it:** 1. Set up availability and latency monitoring for these endpoints. 2. Define service targets (e.g. 99.9% availability, p95 under 2 seconds). 3. Define alerts and an incident process for outages. **How to verify:** The monitoring dashboard compares 30-day availability and p95 latency of agent endpoints to target. **AI prompt:** ```text Create a monitoring and alerting plan for the API, UCP and MCP endpoints agents use on {site}: metrics, thresholds and incident process. ``` ### Send users a clear, detailed confirmation for agent orders Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Users should know an agent placed the order and be able to check it right away. A clear confirmation catches wrong orders early and reduces disputes. **How to do it:** 1. State product, quantity, price, address and delivery date clearly in the confirmation. 2. Say that the order was placed through an agent. 3. Add a one-click cancel or edit link. **How to verify:** The confirmation for a test agent order includes all order details and a cancel link. **AI prompt:** ```text Write an order confirmation email template for {site} for orders placed through agents: summary, agent details, cancel and support links. ``` ## Trust, identity and governance When agents act for users, authentication, consent, logging and security take on new importance. This section covers making agent interactions safe and auditable. ### Decide how you will recognize and authorize agents acting for users Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** Telling apart a real user, an agent authorized by the user and a malicious bot is the basis for consent, liability and security decisions. **How to do it:** 1. Define the methods you support for agent access (OAuth delegated access, signed requests, platform tokens). 2. Define allowed actions per method. 3. Give unauthenticated agents public read access only. **How to verify:** A written agent authentication policy maps methods to action types. **AI prompt:** ```text Draft an agent authentication policy for {site}: supported methods, actions allowed with each, and rules for unauthenticated agents. ``` **Sources:** , ### Set thresholds for which actions require human approval Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Leaving everything automatic is risky, while requiring approval for everything makes the agent channel useless. Thresholds by amount, action type and risk strike the balance. **How to do it:** 1. Classify actions by risk level. 2. Set approval thresholds by amount and action type. 3. Apply them to payment, refund and account change flows. **How to verify:** An approval threshold table is documented and tested in the system. **AI prompt:** ```text Propose a threshold table for {site} defining when agent actions need human approval: amount limits, action types and risk indicators. ``` ### Get explicit, just-in-time confirmation from the user at critical steps Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** A broad permission granted earlier does not stop an agent from doing something unexpected. Explicit confirmation at the moment of payment or data sharing strengthens both security and legal evidence. **How to do it:** 1. Identify payment, address change and data sharing steps. 2. Show the user a summary and ask for explicit confirmation at these steps. 3. Record the time and content of the confirmation. **How to verify:** In a test agent order, the user confirms a summary before payment and a record is created. **AI prompt:** ```text Design the agent action steps on {site} that need just-in-time user confirmation and the information to show on the confirmation screen. ``` ### Keep tamper-proof logs of agent actions for at least 12 months Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** In a dispute, chargeback or security incident, you must be able to show which agent did what, for whom and when. **How to do it:** 1. Log agent identity, user, action, time and consent. 2. Store logs in a tamper-proof store. 3. Set retention in line with regulations (e.g. at least 12 months). **How to verify:** The full step log for a random agent order can be retrieved. **AI prompt:** ```text Design an audit log schema for agent actions on {site}: fields, retention, access rights and privacy considerations. ``` ### Define a procedure to roll back faulty agent actions Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** For bulk faulty orders, wrong refunds or bad data changes, fast rollback limits customer and financial damage. **How to do it:** 1. List reversible actions and how to reverse them. 2. Build tools for bulk cancellation and refunds. 3. Test the procedure with a drill. **How to verify:** The rollback procedure is documented and was tested in the last 6 months. **AI prompt:** ```text Write a rollback procedure for {site} to bulk-cancel and refund faulty agent orders. ``` ### Prepare an incident response plan for agent-related incidents Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** Abuse, data leaks or faulty automated actions require fast, coordinated response. Without a plan, decisions stall in the middle of a crisis. **How to do it:** 1. Define agent-related incident types. 2. Set owners, communication channels and decision authority. 3. Include notification processes to platforms and regulators where required. **How to verify:** The incident response plan covers agent scenarios, with at least one drill a year. **AI prompt:** ```text Draft an incident response plan for agent-related incidents on {site}: incident types, roles, first-60-minute steps and notification duties. ``` ### Keep user content on your pages from carrying harmful instructions to agents Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Instructions hidden in reviews, Q&A or product descriptions (“ignore previous instructions and ...”) can mislead agents reading the page, harming both your users and your brand. **How to do it:** 1. Scan user content for hidden text, unusual instruction patterns and invisible characters. 2. Present user content in clearly marked sections. 3. Treat external content as data, not instructions, in your own agents. **How to verify:** User content moderation rules include checks for prompt injection patterns. **AI prompt:** ```text Create a moderation checklist and example patterns to detect prompt injection in reviews and Q&A content on {site} that could mislead agents. ``` ### Protect review and content channels from fake reviews and data poisoning Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** Agents and models use reviews and community content as evidence. Fake review campaigns or manipulated data can target you or your competitors. **How to do it:** 1. Use verified purchase and anomaly detection for reviews. 2. Monitor sudden review waves and suspicious accounts. 3. Report manipulation to platforms when detected. **How to verify:** The review system has verified purchase labels and anomaly alerts enabled. **AI prompt:** ```text Suggest monitoring rules for {site} to detect signs of fake reviews and data poisoning in reviews and community content. ``` ### Define actions agents may not take and block them technically Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Actions such as account deletion, bulk data export or sale of restricted products should be closed to agents. A written prohibited list must be backed by technical controls. **How to do it:** 1. List actions closed to agents. 2. Block them technically in API and MCP scopes. 3. Publish the list in developer documentation. **How to verify:** An action on the prohibited list is rejected when attempted with an agent identity. **AI prompt:** ```text Suggest a list of actions {site} should keep closed to agents and a technical blocking method for each. ``` ### Clarify liability sharing with third-party agents in contracts and terms Priority: Low priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** When an agent places a wrong order and it is unclear whether the user, the agent provider or you are responsible, disputes drag on. **How to do it:** 1. Add provisions on agent-initiated actions to your terms of use. 2. Review liability clauses in platform contracts. 3. Walk through sample dispute scenarios with legal. **How to verify:** The terms of use include a section on agent-initiated actions. **AI prompt:** ```text Draft a clause for the {site} terms of use on transactions made through AI agents, and list questions for legal review. ``` ## Product visibility in AI shopping When agents recommend products, they look at product data more than the brand. This section covers measuring how often and how accurately your products are recommended in AI shopping answers versus competitors. ### Build a shopping prompt set of purchase-intent product questions Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: SEO, Business. **Why it matters:** Visibility on general brand questions does not show visibility on product questions like “best wireless earbuds under $150”. You need a separate set per product category. **How to do it:** 1. Write prompts with budget, features and use cases for priority categories. 2. Run them in ChatGPT shopping, Google AI Mode, Gemini and Perplexity. 3. Record recommended products, prices and sellers. **How to verify:** A dated, category-based shopping prompt set and results log exists. **AI prompt:** ```text Create 30 purchase-intent prompts with budget and features across 3 priority product categories for {site}, and suggest a table template to record the results. ``` ### Check your products appear correctly in AI shopping cards Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: SEO. **Why it matters:** Product cards in shopping answers are built from feeds and structured data. A wrong image, outdated price or missing seller lowers clicks and trust. **How to do it:** 1. Find your product cards in the prompt set results. 2. Check image, price, stock, rating and seller details. 3. Fix the source of errors in the feed or markup. **How to verify:** Checked product cards show the same price and stock as the site. **AI prompt:** ```text Create an audit form for checking whether {site} products appear correctly in AI shopping cards: image, price, stock, rating, seller and link. ``` ### Track the accuracy of price and spec details assistants give about your products Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Assistants may quote old prices, wrong specs or discontinued models. These errors come back to you as returns and complaints. **How to do it:** 1. Ask assistants about your priority products. 2. Compare price, specs and stock with real data. 3. Find and fix the source of errors (old page, marketplace, third-party site). **How to verify:** An error log and fix status for assistant answers is tracked for priority products. **AI prompt:** ```text Prepare accuracy test questions to ask AI assistants about {site} priority products, and suggest a table comparing answers with real product data. ``` ### Track how often competitor products are recommended per category Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: SEO, Business. **Why it matters:** Agents usually recommend a few products for a given budget or feature set. Knowing why competitor products are chosen guides product data and pricing decisions. **How to do it:** 1. Log every recommended product in the shopping prompt set by brand and seller. 2. Calculate share of voice per category. 3. Note the highlighted features and prices of competitor products. **How to verify:** A category-level competitor product share of voice table is current. **AI prompt:** ```text Create a report template for {site} that analyzes competitor products’ share of voice and reasons for selection in shopping questions. ``` ### Provide the product attributes agents filter on, with standard values Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Content. **Why it matters:** Filters like “waterproof”, “vegan” or “iPhone compatible” decide agent recommendations. A missing attribute means the product is never considered for those questions. **How to do it:** 1. Identify the attributes users filter on per category. 2. Fill them with standard values on the page, in structured data and in the feed. 3. Track fill rates per category. **How to verify:** Critical attributes in priority categories have a fill rate above 90%. **AI prompt:** ```text List 15 critical attributes agents may use when recommending products in this category for {site}, with standard value suggestions for each: [category]. ``` ### Share promotions and discounts as structured promotion data Priority: Low priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Agents try to find the best offer for the user. Merchant Center promotions and the sale\_price field in the feed get your promotions shown on shopping surfaces. **How to do it:** 1. Define campaigns as Merchant Center promotions. 2. Give sale prices with sale\_price and validity dates. 3. Check prices revert on time when the campaign ends. **How to verify:** Active campaigns appear as approved promotions in Merchant Center. **AI prompt:** ```text Explain how to configure {site} campaigns with Merchant Center promotions and feed fields, and the effect on visibility in AI shopping surfaces. ``` ### Keep store quality signals strong: ratings, shipping and returns Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business. **Why it matters:** Google store ratings and Merchant Center store quality signals affect how prominently a seller is shown on shopping surfaces, and agents also prefer trustworthy sellers. **How to do it:** 1. Review store quality and experience signals in Merchant Center. 2. Improve weak points in shipping speed, return policy and customer service. 3. Keep collecting store reviews. **How to verify:** Store quality signals in Merchant Center are “good” or better. **AI prompt:** ```text Create an action plan for {site} to improve Merchant Center store quality signals: shipping, returns, customer service and reviews. ``` ## Measuring the agent channel Agent orders and agentic browser sessions are often indistinguishable in classic analytics reports. This section makes the volume, quality and problems of the agent channel visible. ### Tag orders from agents and protocols with a source field Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** If orders from UCP, merchant apps or MCP are not tagged separately, the channel’s real contribution and problems stay invisible. **How to do it:** 1. Add channel and protocol fields to the order record (e.g. ucp-google, chatgpt-app, mcp). 2. Pass the field into analytics and reporting systems. 3. Report agent orders separately from classic web orders. **How to verify:** The order database has the agent channel field populated and reports show it separately. **AI prompt:** ```text Propose a data model for tagging orders from agent channels on {site}: fields, values and how they flow into reporting. ``` ### Log failed attempts in agent flows by step Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** When an agent fails at a step, the user usually never reaches you. Error logs are the only trace of the lost sale. **How to do it:** 1. Log error codes and the step on agent API and checkout endpoints. 2. Group errors by type (validation, stock, payment, timeout). 3. Set up a weekly error report and threshold alerts. **How to verify:** A weekly report shows step-level success rates and the most common error types in agent flows. **AI prompt:** ```text Design a log and report structure for {site} that tracks failed agent attempts by step and error type. ``` ### Try to distinguish agentic browser sessions in analytics Priority: Medium priority. Effort: A few days. Evidence: Experimental. Roles: Developer. **Why it matters:** Agentic browsers often look like ordinary Chrome. Combining user agent hints, behavior patterns and server logs can separate some of them; there is no reliable method yet. **How to do it:** 1. Track user agent and header hints of known agentic browsers. 2. Flag very fast, regular interaction patterns. 3. Report estimated agent sessions as a separate segment and note the uncertainty. **How to verify:** Analytics has a defined segment and method note for estimated agent sessions. **AI prompt:** ```text Write a method note for {site} explaining signals (user agent, headers, behavior) to estimate agentic browser sessions and their limits. ``` ### Analyze API and MCP tool usage by agent and tool Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Which agent uses which tool and how often shows whether your capabilities create value and what needs work. **How to do it:** 1. Log client, tool, duration and outcome for every API and MCP call. 2. Report usage and error rates per tool. 3. Review tools that are never used or fail often. **How to verify:** A monthly report shows usage and error rates for MCP tools and API endpoints. **AI prompt:** ```text Design usage analytics by client and tool for the {site} MCP server and API: log fields, metrics and monthly report structure. ``` ### Define core KPIs and baselines for the agent channel Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Without KPIs such as orders, average order value, conversion, return and cancellation rates, you cannot decide whether the channel is working. **How to do it:** 1. Pick 5–7 core KPIs for the agent channel. 2. Record baselines and measurement methods. 3. Report KPIs side by side with the classic web channel. **How to verify:** Agent channel KPIs, baselines and dates are documented. **AI prompt:** ```text Suggest 7 core KPIs to measure the success of the {site} agent commerce channel, with a definition, data source and target-setting method for each. ``` ### Track return, cancellation and complaint rates for agent orders separately Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** The agent channel can bring high volume yet turn unprofitable through returns and disputes. Quality KPIs are the basis for expanding or narrowing scope. **How to do it:** 1. Calculate return, cancellation, chargeback and complaint rates for agent orders. 2. Break them down by category and protocol. 3. Act per product or channel when thresholds are exceeded. **How to verify:** Agent order quality KPIs appear by category in the monthly report. **AI prompt:** ```text Create a monthly report template tracking agent order quality for {site}: returns, cancellations, chargebacks, complaints and action thresholds. ``` ## Advertising on AI surfaces ChatGPT and Google’s AI experiences have started offering ad inventory. This section covers the eligibility, measurement and testing steps needed to enter these channels deliberately. ### Check whether ChatGPT ads are available in your target markets Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** ChatGPT ads launched in the US and had expanded to about 89 countries by October 2026, but not every market or targeting option is open. Confirm the status of your target markets, including Turkey, from a current source. **How to do it:** 1. Check the current country list in OpenAI’s ads documentation. 2. Compare it with your target markets. 3. Set a follow-up date for markets not yet open. **How to verify:** A dated note lists target markets and ChatGPT ads availability. **AI prompt:** ```text List the official sources I should check for ChatGPT ads availability in the target markets of {site}, and the questions to answer before planning a campaign. ``` **Sources:** , ### Clarify legal entity, payment and verification requirements for the ad account Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** New ad platforms may set country, legal entity and payment method conditions at signup. Knowing them early protects the campaign timeline. **How to do it:** 1. Read the platform’s advertiser verification requirements. 2. Decide on a legal entity in the target market or an agency route if needed. 3. Prepare payment method and billing details. **How to verify:** Required documents and the legal entity decision for the ad account are documented. **AI prompt:** ```text Create a checklist of legal entity, tax, payment and verification requirements {site} may face when opening accounts on AI ad platforms. ``` ### Check whether your vertical is restricted in AI ad policies Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Health, finance, legal and political ads may be restricted or banned on AI surfaces. Preparation without reading the policy is wasted. **How to do it:** 1. Read the platforms’ ad policies for your vertical. 2. List restricted products and messages. 3. Prepare any required certifications or licenses. **How to verify:** A vertical policy review and restricted content list are documented. **AI prompt:** ```text Prepare a checklist and questions to research restrictions that may apply to the {site} vertical in ChatGPT ads and Google AI ad placements. ``` ### Define the conversational contexts where your product helps, not just keywords Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Content. **Why it matters:** Ads in AI conversations match on conversation context. Clear answers to “when is my product useful?” are the basis of targeting. **How to do it:** 1. List the problems and situations in which customers look for the product. 2. Write a short theme description and fitting message for each. 3. Map themes to landing pages. **How to verify:** A context and theme library covering at least 10 situations is documented. **AI prompt:** ```text Suggest 15 user situations {site} could target in AI conversation ads, each with a short message and a fitting landing page. ``` ### Prepare creatives that meet AI ad placement requirements Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Content. **Why it matters:** In-conversation ads use compact formats such as a short title, a concise description and a square image. Existing search or social creatives may not fit as-is. **How to do it:** 1. Check the platform’s current creative specs. 2. Write short, single-message title and description variants. 3. Prepare images and logos at the right sizes. **How to verify:** At least two spec-compliant creative variants are ready per theme. **AI prompt:** ```text Write 5 short title and description variants for {site} suited to AI conversation ads, each focused on a single benefit. ``` ### Match ad themes to landing pages that answer the topic directly Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Content, SEO. **Why it matters:** AI ad platforms assess how relevant the ad and landing page are to the conversation. The clear, answer-first pages you build for GEO support ad performance too. **How to do it:** 1. Pick or create the most relevant page per theme. 2. Make sure the page answers the theme directly above the fold. 3. Track the mapping in a table. **How to verify:** A table lists a matching landing page and above-the-fold answer for every ad theme. **AI prompt:** ```text Create a table template mapping ad themes to landing pages for {site}, and assess this page’s first screen for fit with its theme: [URL]. ``` ### Set up pixel and server-side conversion tracking for ad platforms Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer. **Why it matters:** Without conversion data, platform optimization does not work and return cannot be measured. Server-side conversion APIs improve accuracy despite browser restrictions. **How to do it:** 1. Install the platform’s pixel or tag. 2. Add the server-side conversion API integration. 3. Test that it works in line with privacy and cookie consent rules. **How to verify:** A test conversion shows in the platform from both the pixel and the server source. **AI prompt:** ```text Explain the steps to set up pixel and server-side conversion tracking on AI ad platforms for {site} and how to keep it consistent with consent management. ``` ### Prepare feeds and campaigns for Google ad placements in AI Overviews and AI Mode Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** Text and Shopping ads from existing Search, Shopping and Performance Max campaigns can appear within AI Overviews, but Google offers this only in certain countries and languages so far, and AI Mode ads are rolling out gradually. Confirm your market in the Google Ads help page. **How to do it:** 1. Check whether these placements are open in your target market and language. 2. Prepare complete product feeds and creative assets. 3. Track these placements in Search, Shopping and Performance Max reporting. **How to verify:** The campaign structure includes Search, Shopping or Performance Max campaigns with complete feeds and assets. **AI prompt:** ```text Create a checklist for {site} covering campaign structure, feed and creative asset requirements to prepare for Google ad placements in AI Overviews and AI Mode. ``` **Sources:** ### Test new AI ad channels with a budget, learning period and A/B plan Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Early results on new channels are misleading, and platforms may lack built-in testing tools. A predefined budget, duration and decision rules prevent hasty calls. **How to do it:** 1. Set a test budget and duration. 2. Define the creatives or themes to compare and the success metric. 3. Do not decide before the learning period ends. **How to verify:** The test plan documents budget, duration, variants and decision rules. **AI prompt:** ```text Create a 6-week test plan for {site} on a new AI ad channel: budget, variants, success metrics, decision rules and reporting. ``` ## Legal, compliance and data Contracts formed through agents, personal data flows and AI-generated ads raise new legal questions. This section lists core compliance steps with a Turkey and EU focus; it does not replace legal advice. ### Review agent-driven order and data flows under data protection law Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Business. **Why it matters:** With agent orders, personal data moves between the platform, payment provider and you. Notice, consent and cross-border transfer rules (e.g. KVKK in Turkey) apply to these flows too. **How to do it:** 1. Map data flows in agent channels. 2. Update privacy notices to cover agent orders. 3. Apply lawful transfer mechanisms for cross-border data flows. 4. Apply data minimization. **How to verify:** A data flow map and updated privacy notice for agent channels exist, with legal review done. **AI prompt:** ```text Create a checklist for {site} to assess personal data flows in agent orders under data protection law: data categories, transfers, notices, consent and retention. ``` **Sources:** ### If you sell to the EU, complete your GDPR and data transfer framework Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Selling to EU consumers and sharing data with agent platforms falls under the GDPR and requires valid legal bases and transfer mechanisms. **How to do it:** 1. Identify EU sales and data processing activities. 2. Update legal bases and notices. 3. Sign data processing agreements with platforms. **How to verify:** Records, notices and data processing agreements for EU activities are complete. **AI prompt:** ```text If {site} sells to the EU, create a checklist of GDPR items to complete for agent channels. ``` **Sources:** ### Label AI-generated ad content in line with Turkish advertising rules Priority: High priority. Effort: Quick win. Evidence: Official source. Roles: Business, Content. **Why it matters:** Amendments to Turkey’s Commercial Advertising and Unfair Commercial Practices Regulation took effect on August 1, 2026. When AI is used in a way that can significantly affect consumers’ economic behavior, and for digital characters indistinguishable from real people, this must be disclosed clearly and distinguishably; ads may not falsely suggest that an AI copy of a real person uses or recommends a product. A label alone does not make a misleading ad lawful. **How to do it:** 1. Inventory ads using AI-generated images, video or characters. 2. Add a clear disclosure that meets the regulation. 3. Check the accuracy of claims separately and get legal sign-off. **How to verify:** Every ad with AI content carries a compliant disclosure, with a creative approval record. **AI prompt:** ```text Create a compliance checklist for AI-generated content in {site} ads under Turkey’s August 1, 2026 advertising regulation amendments, noting where legal advice is needed. ``` **Sources:** ### Assess EU AI Act transparency duties for chatbots and AI content Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Business, Developer. **Why it matters:** The EU AI Act’s transparency obligations (telling users they are interacting with AI, marking synthetic content) have applied since August 2, 2026, with a short grace period for machine-readable marking by generative systems already on the market before then. If you offer chatbots or AI content to EU users, you may be in scope. **How to do it:** 1. List AI systems offered to EU users. 2. Add an AI interaction notice to chatbots. 3. Assess synthetic content marking requirements with legal. **How to verify:** A transparency assessment note exists for AI systems offered to EU users. **AI prompt:** ```text If {site} offers chatbots or AI-generated content to EU users, list the topics to assess under the EU AI Act transparency obligations. ``` **Sources:** ### Apply distance selling and consumer law rules to agent orders Priority: High priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Pre-contract information, withdrawal rights, price transparency and auto-renewal rules do not disappear because an agent placed the order. How the information reaches the user must be planned. **How to do it:** 1. Decide how the pre-contract information and distance contract reach the user for agent orders. 2. Test the withdrawal and return process for agent orders. 3. Check renewal and cancellation rules for subscriptions. **How to verify:** For a test agent order, pre-contract information and the contract were delivered to the user and recorded. **AI prompt:** ```text Create a compliance checklist for agent orders on {site} under distance selling rules: pre-contract information, contract, withdrawal right, delivery and returns. ``` **Sources:** ### Define when a contract is formed through an agent and how consent is recorded Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** In a dispute you must prove when the contract was formed, with whose consent and on what terms. In agent flows that moment can become unclear. **How to do it:** 1. Define the step at which the contract is formed with legal. 2. Record the terms, price and user consent at that moment. 3. Link these records to the audit logs. **How to verify:** The procedure defines the moment of contract formation, and a test order has the matching record. **AI prompt:** ```text Draft a procedure for {site} defining when a contract is formed in agent orders and which evidence to keep. ``` ### Verify product safety, labeling and certification in target markets Priority: Medium priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Agents may recommend your product to users in other countries. Products that do not meet requirements such as CE, UKCA or FDA create legal risk and returns. **How to do it:** 1. List product compliance requirements for each market you sell to. 2. Keep certificates and labels in the product file. 3. Remove non-compliant products from that market’s feed. **How to verify:** Each target market has a product compliance file and a feed exclusion list. **AI prompt:** ```text Create a template to check product safety, labeling and certification requirements for selling {site} products in foreign markets. ``` ### Keep customs tariff (HS) codes and origin data accurate for cross-border sales Priority: Low priority. Effort: A few days. Evidence: Official source. Roles: Business. **Why it matters:** Wrong HS codes or origin data cause customs delays, extra costs and returns, and break the delivery promise you gave agents. **How to do it:** 1. Assign correct HS codes and country of origin to products. 2. Pass them into order and shipping systems. 3. State on the page who pays customs duties. **How to verify:** All products sold abroad have HS code and origin filled. **AI prompt:** ```text Create a checklist explaining how {site} should add HS code, origin and duty information to product data and the order process for cross-border sales. ``` ### Check trademark and image usage rights in target markets Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business. **Why it matters:** Agents and AI surfaces make your brand name and images visible in new markets. An unregistered mark or unlicensed image creates legal risk there. **How to do it:** 1. Check that your trademark registration covers target markets. 2. Verify licenses for product images. 3. Monitor marks similar to your brand name. **How to verify:** Trademark registration status and image license records exist for target markets. **AI prompt:** ```text List the trademark registration, image licensing and brand monitoring items {site} should check when entering new markets. ``` ### Set retention periods for contracts, orders and logs according to law Priority: Medium priority. Effort: Quick win. Evidence: Official source. Roles: Business, Developer. **Why it matters:** Commercial records, e-commerce records and personal data have different retention and deletion rules. Keeping too little loses evidence; keeping too long risks privacy violations. **How to do it:** 1. List record types and their legal retention periods. 2. Update the retention and deletion policy. 3. Include agent records in that policy. **How to verify:** The retention and deletion policy covers agent records and defines automatic deletion rules. **AI prompt:** ```text Draft a retention and deletion policy for {site} covering agent orders, consent records and logs, noting points that need legal review. ``` ## Organization, capability and procurement Agentic readiness spans content, development, operations, legal and finance. Without clear ownership, decision rules and a realistic budget, technical work does not pay off. ### Assign a named owner for agentic readiness Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Feed, protocol, payment and legal work is spread across teams. A single owner unifies priorities and decisions; the role can be part-time but must be named. **How to do it:** 1. Assign an owner and a backup. 2. Name team-level owners for each section. 3. Add the responsibility to goals and the job description. **How to verify:** The organization document names the agentic readiness owner and section owners. **AI prompt:** ```text Create a RACI table for {site} showing the roles of e-commerce, development, operations, legal and finance teams in agentic commerce readiness. ``` ### Document authority tiers for agent decisions Priority: High priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** If it is unclear where AI suggests, where a human approves and what runs fully automated, you get both risk and inefficiency. **How to do it:** 1. Split actions into “suggest”, “human approval” and “fully automated” tiers. 2. Name the authorized roles for each tier. 3. Review the tiers at least twice a year. **How to verify:** The decision tiers document is current and matches system permissions. **AI prompt:** ```text Propose a table for {site} showing which tier (suggest, human approval, automated) agent decisions fall into for pricing, stock, orders, returns and customer communication. ``` ### Decide who will implement: in-house, agency or platform Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Feed, structured data, protocol and API work need different expertise. Without a clear resource, work stalls or stays half done. **How to do it:** 1. Define the expertise needed per work package. 2. Decide between in-house, agency or platform support. 3. Plan budget and timeline around the chosen resource. **How to verify:** The resource plan names the responsible resource and timeline for each work package. **AI prompt:** ```text Create a resource plan template for {site} comparing in-house, agency and platform options for agentic readiness work packages (feed, structured data, UCP, MCP, payments, measurement). ``` ### Base agency and vendor contracts on verifiable outcomes, not hours Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Outcomes like “feed validated, error rate under 2%” instead of “X hours of consulting” make what you pay for measurable. **How to do it:** 1. Write verifiable delivery criteria per work package. 2. Tie payments to those criteria. 3. Include acceptance tests in the contract. **How to verify:** Active vendor contracts contain outcome-based delivery criteria. **AI prompt:** ```text Suggest 10 outcome-based delivery criteria and acceptance tests {site} could add to an agency contract for agentic readiness work. ``` ### Have at least one person in-house who can audit feeds and structured data Priority: Medium priority. Effort: A few days. Evidence: Emerging standard. Roles: Business, Developer. **Why it matters:** Even with outsourcing, errors go unnoticed if nobody in-house understands the data. The most effective learning starts with a real task and repeats with training and feedback. **How to do it:** 1. Name the person responsible for feeds and JSON-LD. 2. Start with a small real task and support it with training. 3. Have them run a short monthly data quality review. **How to verify:** Training records show at least one person able to audit feeds and structured data. **AI prompt:** ```text Create a 4-week, task-based learning plan for one {site} team member to learn feed and structured data auditing. ``` ### Hold a monthly review meeting for agentic readiness Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Protocols, platform programs and channel performance change fast. A regular meeting stops decisions from being postponed and issues from piling up. **How to do it:** 1. Put a monthly meeting on the calendar. 2. Fix the agenda: KPIs, protocol changes, issues and decisions. 3. Record decisions and owners. **How to verify:** Meeting notes and decision logs exist for the last three months. **AI prompt:** ```text Create a monthly agentic readiness meeting agenda template for {site}: KPIs, protocol updates, open risks, decisions and actions. ``` ### Allocate a budget and set realistic return expectations Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business. **Why it matters:** Agentic commerce is early and channel volumes are still small in many markets. Overly high expectations lead to giving up early, while no budget means falling behind. **How to do it:** 1. Budget foundational work (feeds, data, access) separately from experiments (protocols, ads). 2. Set measurable milestones for each. 3. Reallocate at quarter end based on results. **How to verify:** The budget document separates foundational and experimental items with milestones. **AI prompt:** ```text Propose a framework splitting the {site} agentic readiness budget into foundational and experimental items, with realistic 6-month targets for each. ``` ### Apply a measurable readiness gate before launching agent integration Priority: High priority. Effort: A few days. Evidence: Emerging standard. Roles: Developer, Business. **Why it matters:** If many product pages are unreadable without JavaScript or the purchase API is slow, agent integration produces a bad experience. Simple thresholds prevent this. **How to do it:** 1. Set thresholds, e.g. at least 80% of product pages readable without JavaScript and cart/checkout API responses under 2 seconds. 2. Run a JavaScript-off sample crawl and API latency measurement. 3. Do not launch until thresholds are met. **How to verify:** The readiness gate report shows measured results for both thresholds with a date. **AI prompt:** ```text Design a pre-launch readiness gate test for {site} agent integration: JavaScript-off product page sample, API latency measurement and pass criteria. ``` ### Re-measure the agentic readiness score every quarter and compare Priority: Medium priority. Effort: Quick win. Evidence: Emerging standard. Roles: Business, SEO. **Why it matters:** Readiness is not a one-off certificate; the score drops as protocols and platforms change. Quarterly measurement shows regressions early. **How to do it:** 1. Run this checklist end to end every quarter. 2. Record the score and changed items. 3. Assign an owner and date to items that regressed. **How to verify:** Readiness scores and a comparison for the last two quarters are recorded. **AI prompt:** ```text Create a scoring and comparison template for the quarterly agentic readiness review of {site}. ``` ## Frequently Asked Questions ### What is a GEO checklist? A GEO (Generative Engine Optimization) checklist lists what your website needs so AI assistants such as ChatGPT, Gemini, Claude and Perplexity can read it, understand it and cite it: crawler access, technical foundation, structured data, answer-ready content and brand signals. ### How is GEO different from SEO? SEO aims at rankings on a results page; GEO aims at being named and cited in AI answers. Much of the technical base is shared (indexability, speed, structured data), but GEO also needs access for AI crawlers, quotable passages and consistent brand facts. ### What does the agentic checklist cover? The agentic list is about AI agents that read and act on your site for a user: discovery files such as llms.txt, machine-readable pages, labelled forms, stable URLs, .well-known discovery files and the price and stock data shopping agents need. ### What does the automatic check measure? When you enter your domain we read your homepage, robots.txt, sitemap, llms.txt and the documented .well-known files from the outside: access for each AI crawler, HTTPS, response time, JSON-LD schema, canonical, title and description, text readable without JavaScript and more. No AI calls, no credits, and nothing is ticked for you. ### Where is my progress stored? Your ticks are stored in this browser; no account is needed. When you sign in with a GeoDog account, your progress is also saved to the account and synced item by item with your other devices. A share link is only created when you ask for one. ### How is the score calculated? Each item has a weight by priority (high 3, medium 2, low 1). The score is the weight of completed items divided by the total weight of the items that fit your site; items marked not applicable and items outside your chosen site type are left out. The score maps to five levels. ### Is llms.txt required? No. llms.txt is a proposal, not a standard, and Google says it does not affect visibility. It is on the list because it is cheap and some agents and developer tools use it, not as a ranking factor. ### Does completing the list guarantee visibility in AI answers? No. The list removes what stops assistants from reading and understanding your site. Whether you are actually named takes regular measurement of the questions your customers ask; GeoDog does that for you across ChatGPT, Gemini, Claude and Perplexity.