{"id":2123,"date":"2026-06-04T20:32:44","date_gmt":"2026-06-04T20:32:44","guid":{"rendered":"https:\/\/aigrowthagent.co\/articles\/agent-cards-best-practices\/"},"modified":"2026-07-05T05:41:11","modified_gmt":"2026-07-05T05:41:11","slug":"agent-cards-best-practices","status":"publish","type":"post","link":"https:\/\/aigrowthagent.co\/articles\/agent-cards-best-practices\/","title":{"rendered":"Agent Cards Best Practices for AI Agent Discovery"},"content":{"rendered":"<p><em>Written by: Mariana Fonseca, Editorial Team, AI Growth Agent | Last updated: July 4, 2026<\/em><\/p>\n<h2 id=\"key-takeaways\">Key Takeaways<\/h2>\n<ul>\n<li>Agent cards are standardized JSON documents that let AI agents discover, evaluate, and delegate tasks to each other without human help.<\/li>\n<li>Publishing at the canonical \/.well-known\/agent-card.json path with semantic versioning, health signals, and explicit autonomy levels builds fast trust with client agents and orchestrators.<\/li>\n<li>Every production card must declare permissions before capabilities, list tool limitations alongside skills, and include authentication schemes to prevent authorization creep.<\/li>\n<li>Pairing agent cards with llms.txt files, robots.txt signals, and a complete agentic technical SEO stack sharply increases discoverability across AI surfaces.<\/li>\n<li>AI Growth Agent helps teams ship production-ready agent cards and the full discovery stack, and you can <a href=\"https:\/\/aigrowthagent.co\/book-a-demo\/\" target=\"_blank\">see how we would build yours<\/a> to get started.<\/li>\n<\/ul>\n<h2>What Is an Agent Card?<\/h2>\n<p><a href=\"https:\/\/cogitx.ai\/blog\/ai-agents-complete-overview-2026\" target=\"_blank\" rel=\"noindex nofollow\">Google&#8217;s Agent-to-Agent (A2A) protocol, introduced in April 2025<\/a>, formalized the agent card as the standard discovery mechanism for multi-agent systems. Under A2A, each agent publishes a JSON file at a known URL that declares its capabilities, reachability, authentication requirements, and accepted data formats. When one agent needs to delegate a task, it fetches the target agent&#8217;s card, checks compatibility, and sends a structured request. The work is then tracked through a Task object that holds the request, status, and results.<\/p>\n<p><a href=\"https:\/\/mindstudio.ai\/blog\/six-agent-protocols-ai-builders-2026\" target=\"_blank\" rel=\"noindex nofollow\">A2A communication runs over HTTP and supports synchronous responses, progressive streaming, asynchronous task execution with completion notifications, and multi-turn interactions<\/a>. Agent cards complement the Model Context Protocol (MCP) rather than replace it. A2A handles agent-to-agent delegation and orchestration. MCP handles each agent&#8217;s connections to external tools and data sources.<\/p>\n<p>If your agents are not surfacing in AI-driven discovery pipelines, the card is the first place to fix. <a href=\"https:\/\/aigrowthagent.co\/book-a-demo\/\" target=\"_blank\">Get a free audit of your current discovery endpoints and schema<\/a>.<\/p>\n<h2>Core Components of an Agent Card<\/h2>\n<p><a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">A complete A2A agent card includes identity and description fields, supported modalities (text, JSON, audio, video), authentication requirements (OAuth 2.0, API keys, service account tokens), and optional structured skills with pricing information.<\/a> The card also carries a <code>capabilities<\/code> block that advertises protocol-level features such as <code>streaming: true<\/code> for incremental updates on long-running tasks and <code>pushNotifications: true<\/code> for proactive client notifications.<\/p>\n<p>Beyond the A2A minimum, production cards include a <code>provider<\/code> object with organization name and URL, an <code>iconUrl<\/code>, a semantic <code>version<\/code> string, and a <code>documentationUrl<\/code>. Skills appear as discrete capabilities, each with an <code>id<\/code>, <code>name<\/code>, <code>description<\/code>, <code>tags<\/code>, <code>inputModes<\/code>, <code>outputModes<\/code>, and <code>examples<\/code>. Security appears under <code>securitySchemes<\/code> and <code>security<\/code>, listing supported authentication methods and required OAuth2 scopes.<\/p>\n<p>Knowing what fields to include is only half the challenge. How you structure and present those fields determines whether client agents trust your card enough to delegate tasks. The following design rules turn technical completeness into operational trust.<\/p>\n<h2>10 Design Rules That Build Trust in Seconds<\/h2>\n<ol>\n<li><strong>Publish at the canonical well-known path.<\/strong> <a href=\"https:\/\/stacka2a.dev\/learn\/agent-card-spec\" target=\"_blank\" rel=\"noindex nofollow\">Every A2A-compliant agent publishes its card at <code>\/.well-known\/agent-card.json<\/code><\/a>. This convention makes the card predictably fetchable by any client agent or crawler without prior knowledge of the host&#8217;s URL structure.<\/li>\n<li><strong>Use semantic versioning on every release.<\/strong> <a href=\"https:\/\/medium.com\/google-cloud\/the-a2a-1-0-milestone-ensuring-and-testing-backward-compatibility-4aadb007c49b\" target=\"_blank\" rel=\"noindex nofollow\">A2A defines a formal versioning strategy (including protocolVersions and A2A-Version header handling) along with explicit backward-compatibility mechanisms for SDKs and servers<\/a>. Apply these conventions to every card update so client agents can reason about compatibility safely.<\/li>\n<li><strong>Declare autonomy level explicitly.<\/strong> Autonomy level is not implied by capability count. State it as a structured field so orchestrators can apply the correct oversight policy before delegating any task.<\/li>\n<li><strong>List permissions before capabilities.<\/strong> Permissions define what the agent is allowed to do. Capabilities define what it can do. Reversing this order creates authorization creep, where <a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">agents accumulate power without robust delegated user authorization<\/a>.<\/li>\n<li><strong>Separate marketing language from functional claims.<\/strong> Every capability claim in the card must map to a verifiable, invocable skill. Treat unverified claims as marketing copy that belongs in documentation, not in the card.<\/li>\n<li><strong>Include a health and last-active timestamp.<\/strong> A card with no recency signal is indistinguishable from an abandoned endpoint. Publish a <code>lastUpdated<\/code> field and a health-check URL so client agents can confirm the agent is operational before committing a task.<\/li>\n<li><strong>Enumerate tool limitations, not just tool names.<\/strong> List rate limits, unsupported input types, and known failure modes alongside each tool declaration. Clear limitations prevent client agents from discovering constraints through failed tasks.<\/li>\n<li><strong>Pair the card with an <code>llms.txt<\/code> file.<\/strong> <a href=\"https:\/\/openai.com\/index\/harness-engineering\" target=\"_blank\" rel=\"noindex nofollow\">Agent-readable reference material served alongside structured discovery endpoints gives AI surfaces the context they need to cite and invoke correctly<\/a>. The <code>llms.txt<\/code> file acts as the natural language companion to the machine-readable card.<\/li>\n<li><strong>Validate schema before every deployment.<\/strong> An invalid JSON structure silently breaks discovery. Run schema validation as part of the CI pipeline, not as a post-deployment check.<\/li>\n<li><strong>Cross-reference the card with your <code>robots.txt<\/code> and sitemap.<\/strong> <a href=\"https:\/\/apievangelist.com\/blog\/2026\/05\/16\/making-the-api-evangelist-network-agent-readable\" target=\"_blank\" rel=\"noindex nofollow\">Explicit AI consent signals in <code>robots.txt<\/code> and RFC 8288 Link headers on HTML responses let agents discover machine-readable surfaces without parsing HTML<\/a>. These signals compound the discoverability of the card itself.<\/li>\n<\/ol>\n<h2>Signaling Autonomy Level in Your Card<\/h2>\n<p>Clear autonomy signaling prevents orchestrators from guessing how much oversight your agent needs. Analyses of AI agent tool usage show that most tool calls originate from agents with at least one safeguard such as restricted permissions or human approval requirements, and many have a human in the loop. Autonomy level therefore behaves as a spectrum that must be communicated precisely so orchestrators apply the right oversight policy.<\/p>\n<table>\n<thead>\n<tr>\n<th>Level<\/th>\n<th>Badge<\/th>\n<th>When to Use<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Supervised<\/td>\n<td><code>autonomy: supervised<\/code><\/td>\n<td>Every action requires explicit human approval before execution, which fits irreversible or high-stakes operations.<\/td>\n<\/tr>\n<tr>\n<td>Monitored<\/td>\n<td><code>autonomy: monitored<\/code><\/td>\n<td>Agent executes autonomously but logs every action for real-time human review, which fits reversible, moderate-complexity tasks.<\/td>\n<\/tr>\n<tr>\n<td>Autonomous<\/td>\n<td><code>autonomy: autonomous<\/code><\/td>\n<td>Agent plans, executes, and self-corrects without human intervention, which fits only when about 0.8% of actions are irreversible and full audit trails exist.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>AI Growth Agent publishes agent discovery guidance via <code>\/.well-known\/<\/code> endpoints for every client, including autonomy-level declarations that AI crawlers and orchestrators can read without custom integration. <a href=\"https:\/\/aigrowthagent.co\/book-a-demo\/\" target=\"_blank\">See autonomy signaling live on a client domain<\/a> before you commit.<\/p>\n<h2>Visible Permissions and Safe-Action Hierarchy<\/h2>\n<p><a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">A2A agent cards treat security as a discoverable contract, publishing supported authentication methods under <code>securitySchemes<\/code> and declaring required permissions under <code>security<\/code>, such as OAuth2 scopes like <code>netops.read<\/code><\/a>. A visible permissions hierarchy prevents authorization creep and gives enterprise orchestrators the signal they need to approve or reject delegation.<\/p>\n<p><strong>Do:<\/strong><\/p>\n<ul>\n<li>Start by declaring every OAuth2 scope the agent may request, including optional scopes it will request only under specific conditions. This complete inventory prevents orchestrators from encountering undeclared permission requests at runtime.<\/li>\n<li>Within that inventory, separate read permissions from write permissions in distinct scope groups so orchestrators can apply different approval policies to each.<\/li>\n<li>Then, for each declared skill, list the minimum permission set it requires. This skill-level detail lets orchestrators approve delegation on a per-task basis instead of granting blanket access.<\/li>\n<li>Publish a <code>safeActions<\/code> array that enumerates operations the agent can perform without elevated approval, and pair it with a <code>restrictedActions<\/code> array for operations that require delegated user authorization before execution. Together, these arrays give orchestrators a clear map of where human oversight is required.<\/li>\n<\/ul>\n<p><strong>Don&#8217;t:<\/strong><\/p>\n<ul>\n<li>Bundle all permissions into a single broad scope and expect orchestrators to infer boundaries.<\/li>\n<li>Omit authentication requirements from skills that touch external data sources.<\/li>\n<li>Declare permissions that exceed what any single skill actually requires.<\/li>\n<li>Allow authorization checks to occur after task acceptance, which is the primary source of <a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">authorization creep in A2A deployments<\/a>.<\/li>\n<\/ul>\n<h2>Recent Activity and Health Signals<\/h2>\n<p>A card without recency signals is a liability. Client agents fetching a card have no way to distinguish an active, maintained agent from one that has been abandoned for six months unless the card explicitly communicates its operational status.<\/p>\n<p>Include the following fields in every production card:<\/p>\n<ul>\n<li><code>lastUpdated<\/code>: ISO 8601 timestamp of the most recent card revision.<\/li>\n<li><code>healthCheckUrl<\/code>: A URL returning a machine-readable status object (HTTP 200 for healthy, 503 for degraded).<\/li>\n<li><code>uptimeSla<\/code>: The declared availability target, expressed as a percentage.<\/li>\n<li><code>incidentHistoryUrl<\/code>: A link to a public or authenticated status page so orchestrators can evaluate reliability before committing long-running tasks.<\/li>\n<\/ul>\n<p><a href=\"https:\/\/cogitx.ai\/blog\/ai-agents-complete-overview-2026\" target=\"_blank\" rel=\"noindex nofollow\">Under A2A, work is tracked through a Task object that holds the request, status, and results<\/a>. Health signals in the card extend this visibility upstream, giving orchestrators the information they need before a task is submitted rather than after it fails.<\/p>\n<h2>Tool Usage and Limitations Section<\/h2>\n<p><a href=\"https:\/\/linkedin.com\/pulse\/ai-agent-spectrum-definitive-guide-whats-real-rebranded-glen-cathey-sgtae\" target=\"_blank\" rel=\"noindex nofollow\">A true AI agent can independently accept a goal, plan its own approach, execute multi-step actions using tools and data sources, evaluate its own results, and adapt when needed<\/a>. The tools section of the card must reflect this reality accurately, not aspirationally.<\/p>\n<p>For each tool declared in the card:<\/p>\n<ul>\n<li>State the tool name, version, and the specific skill it supports.<\/li>\n<li>Declare rate limits: requests per minute, requests per day, and burst limits.<\/li>\n<li>List unsupported input types explicitly. If the tool cannot process audio, state that in the card rather than returning an error at runtime.<\/li>\n<li>Document known failure modes and the agent&#8217;s fallback behavior when the tool is unavailable.<\/li>\n<li>Include a <code>toolDocumentationUrl<\/code> for each tool so client agents can retrieve deeper specifications without querying the host agent.<\/li>\n<\/ul>\n<p>Omitting limitations is the most common trust failure in production agent cards. An orchestrator that discovers a limitation through a failed task will deprioritize the agent in future delegation decisions.<\/p>\n<h2>Agent Card Schema for AI Crawlers<\/h2>\n<p>The following is a production-ready agent card. Publish this file at <code>\/.well-known\/agent-card.json<\/code> on your domain. The <code>\/.well-known\/<\/code> convention follows IETF RFC 5785, which allows agents to reliably locate service metadata at predictable paths.<\/p>\n<pre><code>{ \"$schema\": \"https:\/\/a2aprotocol.ai\/schema\/agent-card\/v1\", \"schemaVersion\": \"1.0.0\", \"name\": \"Content Intelligence Agent\", \"description\": \"Produces authoritative, schema-validated content mapped to a brand's full query universe across Google and ChatGPT surfaces.\", \"version\": \"2.4.1\", \"lastUpdated\": \"2026-07-04T00:00:00Z\", \"provider\": { \"organization\": \"AI Growth Agent\", \"url\": \"https:\/\/aigrowthagent.co\" }, \"iconUrl\": \"https:\/\/aigrowthagent.co\/icon.png\", \"documentationUrl\": \"https:\/\/aigrowthagent.co\/docs\/agent\", \"healthCheckUrl\": \"https:\/\/aigrowthagent.co\/.well-known\/health\", \"uptimeSla\": \"99.9%\", \"autonomy\": \"monitored\", \"url\": \"https:\/\/aigrowthagent.co\/a2a\", \"supportedInterfaces\": [ { \"transport\": \"JSON-RPC\", \"url\": \"https:\/\/aigrowthagent.co\/a2a\/jsonrpc\" } ], \"capabilities\": { \"streaming\": true, \"pushNotifications\": true, \"stateTransitionHistory\": true }, \"defaultInputModes\": [\"text\", \"application\/json\"], \"defaultOutputModes\": [\"text\", \"application\/json\", \"text\/markdown\"], \"securitySchemes\": { \"oauth2\": { \"type\": \"oauth2\", \"flows\": { \"clientCredentials\": { \"tokenUrl\": \"https:\/\/aigrowthagent.co\/oauth\/token\", \"scopes\": { \"content.read\": \"Read published content and topology data\", \"content.write\": \"Publish and update content\", \"analytics.read\": \"Read bot tracking and citation data\" } } } } }, \"security\": [ { \"oauth2\": [\"content.read\"] } ], \"safeActions\": [\"content.read\", \"analytics.read\"], \"restrictedActions\": [\"content.write\"], \"skills\": [ { \"id\": \"universe-mapping\", \"name\": \"Query Universe Mapping\", \"description\": \"Maps a brand's full universe of seed terms and long-tail queries using real-time Google and ChatGPT data.\", \"tags\": [\"seo\", \"llmo\", \"discovery\"], \"inputModes\": [\"text\", \"application\/json\"], \"outputModes\": [\"application\/json\"], \"toolLimitations\": { \"requestsPerMinute\": 60, \"unsupportedInputTypes\": [\"audio\", \"video\"], \"knownFailureModes\": [\"Rate limit exceeded returns 429 with Retry-After header\"] }, \"examples\": [ { \"input\": \"Map the query universe for an adjustable bed retailer in Canada.\", \"output\": \"Topology JSON with seed terms and long-tail query clusters.\" } ] }, { \"id\": \"content-generation\", \"name\": \"Authoritative Content Generation\", \"description\": \"Produces validated, schema-decorated articles with anti-hallucination checks across primary and external sources.\", \"tags\": [\"content\", \"schema\", \"llmo\"], \"inputModes\": [\"application\/json\"], \"outputModes\": [\"text\/html\", \"text\/markdown\", \"application\/json\"], \"toolLimitations\": { \"requestsPerDay\": 500, \"unsupportedInputTypes\": [\"audio\"], \"knownFailureModes\": [\"Source validation timeout returns partial draft flagged for review\"] } } ], \"llmsTxt\": \"https:\/\/aigrowthagent.co\/llms.txt\", \"llmsFullTxt\": \"https:\/\/aigrowthagent.co\/llms-full.txt\" }<\/code><\/pre>\n<p>Alongside this file, publish a JSON-LD <code>SoftwareApplication<\/code> block in the <code>&lt;head&gt;<\/code> of your primary documentation page so AI crawlers that index HTML can also resolve your agent&#8217;s identity and capabilities through structured data. <a href=\"https:\/\/github.com\/Agent-Card\/ai-catalog\" target=\"_blank\" rel=\"noindex nofollow\">The AI Catalog specification, maintained by the Linux Foundation, also defines static discovery via <code>\/.well-known\/ai-catalog.json<\/code><\/a>, which can reference your agent card by URL for cross-protocol discoverability.<\/p>\n<h2>Connecting Agent Cards to Agentic Technical SEO<\/h2>\n<p>An agent card in isolation is a declaration. An agent card connected to a full agentic technical SEO stack becomes a discovery surface. The two must be built together.<\/p>\n<p>AI Growth Agent ships every client site with the complete stack: <code>\/.well-known\/<\/code> endpoints for agent card guidance and OpenAI discovery, Blog MCP with schema, manifest, discovery, and capability guidance exposed to agents, natural language query parameters at <code>\/?s={query}<\/code> that return personalized and internally linked responses, Markdown served to agent crawlers, and <code>llms.txt<\/code> and <code>llms-full.txt<\/code> published so AI surfaces can read the brand the way they need to. <a href=\"https:\/\/apievangelist.com\/blog\/2026\/05\/16\/making-the-api-evangelist-network-agent-readable\" target=\"_blank\" rel=\"noindex nofollow\">RFC 8288 Link headers injected on every HTML response with <code>rel<\/code> values including <code>agent-skills<\/code> and <code>api-catalog<\/code> enable agents to discover machine-readable surfaces without parsing HTML<\/a>, which extends the reach of the card across every page on the domain.<\/p>\n<p>The agent card is the entry point. The agentic technical SEO stack is what makes the entry point matter at scale.<\/p>\n<h2>Common Mistakes and How to Avoid Them<\/h2>\n<ul>\n<li><strong>Publishing a card once and never updating it.<\/strong> A stale <code>lastUpdated<\/code> timestamp signals abandonment. Automate card regeneration as part of every deployment pipeline.<\/li>\n<li><strong>Conflating agent washing with genuine capability.<\/strong> Every skill declared in the card must be invocable and verifiable.<\/li>\n<li><strong>Omitting the <code>securitySchemes<\/code> block.<\/strong> <a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">A2A does not implement identity itself, relying on enterprise identity providers for enforcement<\/a>. A card without explicit security declarations forces client agents to assume the worst and skip delegation.<\/li>\n<li><strong>Skipping schema versioning.<\/strong> <a href=\"https:\/\/codilime.com\/blog\/a2a-protocol-explained\" target=\"_blank\" rel=\"noindex nofollow\">A2A does not yet define a standard approach for schema versioning or backward compatibility<\/a>, so teams that do not implement it manually break client agents silently when capabilities change.<\/li>\n<li><strong>Declaring capabilities without limitations.<\/strong> Tool limitations act as trust signals. Omitting them does not make the agent appear more capable, it makes it appear less reliable.<\/li>\n<li><strong>Failing to cross-reference the card with <code>llms.txt<\/code>.<\/strong> The card tells agents what the agent can do. The <code>llms.txt<\/code> file tells AI surfaces what the brand knows. Both are required for full discovery coverage.<\/li>\n<li><strong>Missing the <code>healthCheckUrl<\/code>.<\/strong> <a href=\"https:\/\/mindstudio.ai\/blog\/six-agent-protocols-ai-builders-2026\" target=\"_blank\" rel=\"noindex nofollow\">A2A models interactions as stateful tasks with a lifecycle (submitted, working, completed, failed) that both agents can monitor<\/a>. Without a health endpoint, orchestrators cannot confirm operational status before committing a task.<\/li>\n<\/ul>\n<p>AI Growth Agent maps the full universe of agent-card queries, produces authoritative content against each one, and publishes with the exact schema, <code>\/.well-known\/<\/code> endpoints, and <code>llms.txt<\/code> files that AI surfaces require. <a href=\"https:\/\/aigrowthagent.co\/book-a-demo\/\" target=\"_blank\">See the full agentic technical SEO stack live on your domain<\/a>.<\/p>\n<h2>Conclusion<\/h2>\n<p>The discovery shift is already underway. <a href=\"https:\/\/cogitx.ai\/blog\/ai-agents-complete-overview-2026\" target=\"_blank\" rel=\"noindex nofollow\">A2A agent cards are the standardized mechanism by which agents discover each other, understand capabilities, and delegate tasks across team or vendor boundaries<\/a>, and the brands that publish production-ready cards today are training the next generation of orchestrators with their own narrative. The brands that wait leave that narrative to whatever happens to be sitting on the open web.<\/p>\n<p>Headless marketing is the architecture that makes agent card best practices operational at scale. One engine maps the full universe of agent-card queries, produces living content validated against primary sources, and publishes with the exact discovery endpoints and schema that AI surfaces need to find, trust, and cite the brand. No agency stack, no extra headcount, no content that goes stale the day it ships.<\/p>\n<p>Traditional search tools show you where your brand stands. AI Growth Agent makes your brand the answer. <a href=\"https:\/\/aigrowthagent.co\/book-a-demo\/\" target=\"_blank\">Get your first production-ready article live within a week<\/a>.<\/p>\n<h2>Frequently Asked Questions<\/h2>\n<h3>What is the difference between an A2A agent card and an MCP tool schema?<\/h3>\n<p>An A2A agent card is a JSON document published at a well-known URL that describes an entire agent: its identity, skills, supported modalities, authentication requirements, autonomy level, and endpoint locations. It is designed for agent-to-agent discovery and delegation, allowing one agent to find and invoke another without prior hard-coded integration. An MCP tool schema, by contrast, describes a specific tool that a single agent can use, fetched via a tools\/list request at connection time. The two are complementary. A2A handles how agents find and delegate to each other, while MCP handles how each agent connects to the external tools and data sources it needs to complete a task. Production implementations use both, with the agent card serving as the outer discovery layer and MCP tool schemas operating inside each agent&#8217;s own capability boundary.<\/p>\n<h3>How often should an agent card be updated, and what triggers a version increment?<\/h3>\n<p>Teams should update an agent card every time a capability changes, a new skill is added or removed, authentication requirements shift, a tool limitation is discovered, or the health endpoint URL changes. The lastUpdated timestamp must reflect the actual date of the most recent revision, not the date the card was first published. Semantic versioning applies the same conventions as software releases. Increment the patch version for corrections to existing fields, the minor version for additive changes that do not break existing client agents, and the major version for changes that remove or restructure fields in ways that break backward compatibility. Because A2A does not yet define a formal standard for schema versioning, teams must implement and enforce this discipline manually as part of their deployment pipeline. Automating card regeneration on every deployment is the most reliable way to keep the lastUpdated field accurate and prevent client agents from treating an active endpoint as abandoned.<\/p>\n<h3>What is the relationship between an agent card and agentic technical SEO?<\/h3>\n<p>An agent card is a single file. Agentic technical SEO is the full stack of signals, endpoints, and formats that make a brand&#8217;s entire web presence readable and citable by AI surfaces. The card declares what an agent can do. The agentic technical SEO stack, which includes the card alongside llms.txt, llms-full.txt, Blog MCP, OpenAI discovery endpoints, natural language query parameters, Markdown content negotiation, and RFC 8288 Link headers, determines whether AI crawlers, training agents, and orchestrators can find, trust, and act on the brand at scale. A card published without the surrounding stack is discoverable only to agents that already know to look for it. A card embedded in a complete agentic technical SEO stack is discoverable to every AI surface that touches the domain, which compounds the brand&#8217;s citation surface across every page, every query, and every training sweep.<\/p>\n<h3>How do permissions and autonomy level interact in a production agent card?<\/h3>\n<p>Autonomy level and permissions are separate declarations that must be consistent with each other. Autonomy level tells an orchestrator how much independent judgment the agent is permitted to exercise. Permissions tell the orchestrator what the agent is allowed to do within that judgment boundary. An agent declared as supervised must list only the permissions required for actions that a human will approve before execution. An agent declared as autonomous must list only the permissions it genuinely needs, with restrictedActions clearly separated from safeActions, because an autonomous agent that accumulates broad permissions without explicit scope boundaries creates authorization creep. The safest production pattern is to declare the minimum permission set for each skill individually, publish a safeActions array for operations that require no elevated approval, and publish a restrictedActions array for operations that require delegated user authorization before the task is accepted, not after.<\/p>\n<h3>Why does AI Growth Agent publish agent card guidance via \/.well-known\/ endpoints for every client?<\/h3>\n<p>The well-known URI convention, established by IETF RFC 5785, allows any agent or crawler to locate service metadata at a predictable path without prior knowledge of the host&#8217;s URL structure. Publishing agent card guidance at \/.well-known\/ means that every AI surface, orchestrator, and training agent that touches a client&#8217;s domain can discover the brand&#8217;s agent capabilities, authentication requirements, and discovery endpoints automatically, without requiring a custom integration or a human to point them to the right file. AI Growth Agent includes this as part of the full agentic technical SEO stack delivered to every client, alongside OpenAI discovery, Blog MCP, llms.txt, llms-full.txt, and natural language query parameters, because agent discoverability is not a one-file problem. It is a stack problem, and the brands that publish the complete stack are the ones that get cited.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Master agent card best practices: versioning, permissions &#038; discoverability. AI Growth Agent ships your production-ready agent card fast. Get started.<\/p>\n","protected":false},"author":1,"featured_media":2122,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-2123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"_links":{"self":[{"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/posts\/2123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/comments?post=2123"}],"version-history":[{"count":2,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/posts\/2123\/revisions"}],"predecessor-version":[{"id":3276,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/posts\/2123\/revisions\/3276"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/media\/2122"}],"wp:attachment":[{"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/media?parent=2123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/categories?post=2123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aigrowthagent.co\/articles\/wp-json\/wp\/v2\/tags?post=2123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}