The 44 controls / TS43
TS43 · AI crawling and agents
Access for authorized crawlers is tested with the full user-agent string and reconciled with logs.
Protocol wording · 0.1.0-draft.28 · Documentation view; no website assessment.
Control rule version : 0.1.0-draft.28
Reading guide: start with applicability and required evidence, then read expectations together with their limitations. Understand C, NC, NT and NA outcomes · Prepare a dossier
Expectations and evidence
- Required inputs (protocol identifiers)
- http, logs, operator-docs, intent
- When it applies
- Access-policy tests for declared agents.
- How to check
- Declare operator access separately from test-client treatment; compare its full chain, reconcile logs and qualify its origin honestly under agent-access-v1.
- Expectation
- All three rules pass for the declared test scope, with planned response, qualified correlation and explicitly unverified operator identity; an intended denial can conform.
- Evidence to retain
- Prior plan, reviewed full User-Agent, raw HTTP, native JSONL logs, bound supplied reviews, command/receipt and identity qualification.
- Non-applicability
- No agent to test in the declared policy.
- Limitations
- First profile: assessor-initiated test client; no actual visit, identity, security or operator access inferred. Sources, logs, reviews and receipt are unauthenticated.
- Outcome clarification
- C requires all expectations across the declared scope. NC requires evidenced contradiction; otherwise NT. NA requires evidence of non-applicability.
- Reference scope
- Technical reference; the TSEP acceptance rule remains an editorial proposal.
Atomic rules
TS43-A01 — Full client and expected treatment
- Required inputs (protocol identifiers)
- http, operator-docs, intent
- When it applies
- Each URL and HTTP client within the previously declared test scope.
- How to check
- Read sources and bound review; check the dated HTTP chain then planned test-client response/body.
- Expectation
- Reviewed documentation and response agree with the test plan; retain independent contradictions despite other missing evidence.
- Evidence to retain
- Evidence, dates, bindings and observations under docs/agent-access-evidence.md.
- Assumptions
- Supplied sources, context, log quality and reviews; test scope limited to its client.
- Inconclusive outcome
- Missing client/source/review, incomplete chain, absent test expectation or required body reference.
- Non-applicability
- No automatic atomic exemption.
- Limitations
- First profile: assessor-initiated test client; no actual visit, identity, security or operator access inferred. Sources, logs, reviews and receipt are unauthenticated.
TS43-A02 — Chain reconciled with logs
- Required inputs (protocol identifiers)
- http, logs, intent
- When it applies
- Each URL and HTTP client within the previously declared test scope.
- How to check
- Check export and layer/ID/cache/clock review, then identify each unique in-window line before literal comparison.
- Expectation
- Every hop has an attributed record with matching method, URL, client and status; any qualified difference fails despite another missing hop.
- Evidence to retain
- Evidence, dates, bindings and observations under docs/agent-access-evidence.md.
- Assumptions
- Supplied sources, context, log quality and reviews; test scope limited to its client.
- Inconclusive outcome
- Missing logs, client-supplied/reused ID, duplicate, other layer, unknown format or insufficient window/review.
- Non-applicability
- No automatic atomic exemption.
- Limitations
- First profile: assessor-initiated test client; no actual visit, identity, security or operator access inferred. Sources, logs, reviews and receipt are unauthenticated.
TS43-A03 — Test origin without invented identity
- Required inputs (protocol identifiers)
- http, intent
- When it applies
- Each URL and HTTP client within the previously declared test scope.
- How to check
- Check bound execution receipt and supplied attribution; distinguish assessor test from an operator visit.
- Expectation
- Assessor-test origin, not-verified operator identity and no real-visit claim; any bound contrary claim fails.
- Evidence to retain
- Evidence, dates, bindings and observations under docs/agent-access-evidence.md.
- Assumptions
- Supplied sources, context, log quality and reviews; test scope limited to its client.
- Inconclusive outcome
- Missing receipt/command/attribution, inconsistent dates, absent binding or ambiguous identity status.
- Non-applicability
- No automatic atomic exemption.
- Limitations
- First profile: assessor-initiated test client; no actual visit, identity, security or operator access inferred. Sources, logs, reviews and receipt are unauthenticated.