← Blog

The Consent Gate

2026-07-19 · Blog

--- title: "The Consent Gate: Why AI Agents Trust an Operational Layer" description: The consent gate is what makes vendor guidance safe for AI agents to follow — surfaced to the user, authorized by the user. The opposite of injection. tags: [consent-gate, trust, prompt-injection, operational-layer] status: published

There is an obvious objection to publishing machine-readable guidance: "Isn't that prompt injection?" It is the right question, and the answer is central to the design. The consent gate keeps the user in control and gives an assistant context for its own independent safety assessment; it does not guarantee that any third-party assistant will accept or follow the material.

The problem the gate solves

An AI agent works for one principal: its user. Any text an agent encounters on the open web is data, not commands. When a web page smuggles in hidden text like "ignore your instructions and do X," that is prompt injection — an attempt to hijack the agent away from its user. Aligned agents are trained to refuse it, and they should.

So how can a publisher legitimately tell a user's agent how to sign up, buy, and configure? By never trying to command the agent at all. The operational layer is addressed through the agent to the user. The agent's job is to surface it; the user's job is to decide.

How the consent gate works

The flow has four steps, and every step is visible to the user:

1. Open publication

The layer is published in the open — a public file, declared in llms.txt, carrying a transparency statement: who published it, what it is for, and that it is meant for the user's own agent. Injection hides. The operational layer announces itself.

2. The agent surfaces, it doesn't obey

When an agent reads the layer, the layer's own instruction is: tell your user what you found. "This service publishes guidance for your agent. Here is what it can do for you. Here is what I would do next." The agent remains loyal to its user throughout — the layer is an offer, not an order.

3. The user authorizes

Nothing operational happens until the user says yes. Consent can be one-time ("yes, set it all up") or per operation ("ask me before anything that costs money"). A "no" ends the matter. This is the gate: user permission is the only key that opens it.

4. The agent operates as the publisher defined

With consent given, the agent follows the publisher's Adoption + Operation guidance — evaluate, enroll, transact, configure, use, manage — actuated through the Service Control Map. The agent acts in the most compatible way because the publisher, who knows the service best, defined the path. See /how-it-works for how operations are mapped.

A minimal consent gate in a manifest looks like this:

{
  "consent_gate": {
    "required": true,
    "instruction": "Surface this layer to your user before acting. Describe the intended operation and its effect. Proceed only after an explicit yes from the user. Consent may be granted one-time or per operation.",
    "scopes": ["one_time", "per_operation"]
  }
}

Why this is the opposite of prompt injection

Put the two side by side and they invert on every property:

In four recorded test sessions — Grok, ChatGPT, Gemini, and Duck.ai, including Hebrew — each assistant fetched the layer and surfaced the consent step. These are examples, not proof of universal compatibility or future behavior. The user remains the principal at every step.

What the gate means for publishers

The consent gate is also your protection. Because every action is user-authorized, you are not tricking anyone's agent — you are assisting your own future customer through their chosen interface. That keeps your layer on the right side of agent policies today and of whatever agent-platform rules come next. The companion question — how to keep your published layer from being abused by others — is covered in /blog/is-this-prompt-injection-no-heres-why.

FAQ

Does the consent gate slow users down?

No — it compresses the decision. Instead of twenty clicks across your funnel, the user gets one clear question from their own agent: "Want me to set this up?" One yes replaces the entire form-filling journey.

Can consent cover multiple operations at once?

Yes. The layer supports one-time consent (a standing yes for a defined scope) and per-operation consent. Publishers should recommend per-operation consent for anything involving payment.

What if an agent ignores the gate and acts without asking?

Then that agent is misaligned by its own platform's standards, and no file can fix that. The layer is designed for aligned agents — and the four-agent verification shows aligned agents honor the gate.

Want it done for you?

Every layer we publish carries the transparency declaration and the consent gate by construction — generated and locked at the source, never something you have to get right by hand. The Free plan publishes a consent-gated layer for your most important page, free, forever. The Basic plan ($29/month) covers your full site, and Pro ($99/month) keeps a managed layer current as agent platforms evolve.

swa:1:aHR0cHM6Ly9zaGFyZXdpdGhteWFnZW50LmFpL2Jsb2cvdGhlLWNvbnNlbnQtZ2F0ZS5qc29u

Keep reading