Web Agent Interaction Standard.
An open standard for enabling AI agents to interact with, transact on, and complete actions on websites and APIs on behalf of authenticated human users. The signature layer of the loop: agents that prove a human trusts them.
Stop proving you're human. Start proving you're trusted.
The web was built for humans clicking through pages. But users increasingly delegate tasks to AI agents: “buy this,” “return that,” “book me a flight.” Today, agents must resort to brittle browser automation, DOM scraping, and heuristic form-filling. Sites invest in blocking them. Both sides lose.
WAIS provides the bridge: a structured way for websites to welcome verified agents and for agents to prove they act with legitimate human authorization.
The web spent 20 years building walls against bots pretending to be human. The next era is about welcoming agents that prove a human trusts them.
Five steps per interaction.
Discover
Agent fetches the site's agents.json manifest to learn available actions.
Authenticate
Agent presents a Proof of Delegation token: signed, scoped, time-limited.
Execute
Agent invokes actions using schemas defined in the manifest.
Confirm
High-risk actions trigger a challenge the user must approve.
Report
Site returns structured results the agent can interpret and present.
Into the loop
Every WAIS-signed interaction can land in Valisor as a signed fact, provenance included, replayable later.
Proof of Delegation.
Instead of proving a visitor is human, Proof of Delegation (PoD) proves that an automated agent has been explicitly authorized by a real human to act within defined boundaries.
A PoD token is a cryptographically signed credential that encodes agent identity, user authorization, scoped permissions, constraints, and a platform signature, all verifiable via public key infrastructure.
No CAPTCHAs. No browser fingerprinting. Trust is established cryptographically. The user's identity stays private. Only the fact of authorization is verified.
Four interlocking components.
agents.json
A manifest at the root of any website declaring what agents can do, how to authenticate, and what confirmation is required per action. The robots.txt for the agent era.
Proof of Delegation
Cryptographically signed tokens proving an agent acts on behalf of a verified human. Scoped permissions, constraints, short TTL. Built on JWT and ES256.
Confirmation Protocol
Risk-tiered human-in-the-loop system. Low-risk actions run freely. High-risk ones require explicit user approval. Critical actions demand strong authentication.
WAIS Lighthouse
An audit tool for agent-readiness scoring. Validate your agents.json, test your PoD verification, and measure how ready your site is for agent traffic.
Start small. Expand as you see value.
Manifest only
Publish agents.json with read-only actions. Zero backend changes. Your site becomes discoverable to agents.
Basic interactions
Add medium-risk actions. Implement PoD token verification. Agents can now prepare actions for users.
Full transactions
Enable checkout, returns, cancellations with the confirmation protocol. End-to-end agent workflows.
Proactive
Webhooks and event streams. Agents react to changes in real time. Fully agent-native platform.
Works with what exists.
WAIS complements, not replaces, existing protocols.
- OAuth 2.0: WAIS extends delegation specifically for autonomous agents
- Web Bot Auth (RFC 9421): PoD adds the delegation layer on top of agent identity
- MCP (Anthropic): MCP tools can verify PoD tokens before executing actions
- A2A (Google): agent-to-agent communication can include PoD tokens
- OpenAPI: agents.json can reference existing OpenAPI endpoints
Read the spec.
The full WAIS specification is open and available for review. We welcome feedback from web developers, e-commerce platforms, AI agent builders, and security researchers.
The reference implementation (Python) includes a token issuer, verifier, demo store, and MCP server.
An open initiative.
Spec feedback · Implementation · Pilot integrations · Security review
Need help implementing WAIS? See consulting →