Automation modes

The AOM spec defines three modes: forbidden, allowed (ready), and open. The normative definition is at www.agentobjectmodel.org/spec/v0.1.0/.

forbidden

No automation. Agents may read only what's needed to learn the policy (e.g. surface_id and automation_policy), then must stop. They must not use the rest of the page for planning or actions. For logging, agents should only retain that minimum—e.g. surface_id—and not retain other surface or page content. The agent kits output result: { "forbidden": true, "surface_id": "..." } when exiting so runtimes can log without retaining more.

allowed (ready)

Controlled automation. Agents must treat the AOM as the contract: actions stay within what the site and page AOM allow. They must not add actions based only on DOM or other page content outside the AOM.

open

Permissive. Agents may use the AOM as a guide and may use other page content to infer actions. They still must obey global safety rules and any explicit prohibitions in policy.

Site vs page

Mode can be set at site level (/.well-known/aom-policy.json) and per page (AOM in the page). If the site is forbidden, all pages are forbidden. A page can tighten but not loosen the site policy.

Documentation · Downloads · Surface owners · Agent owners · Validate your AOM surfaces · Spec