AAO's adagents. doesn't cross-check IAB schain, leaving agent authorization unaudited

A fourth trust file, answering a different question

AgenticAdvertising.org (AAO) has published adagents., a publisher-side specification that declares which sales agents are permitted to represent a publisher's inventory. An analysis published on dev.to points out a structural problem with the new file: it answers a different question from the trust chain the IAB Tech Lab already built, and the bid request that actually reaches buyers carries only one of the two answers.

How the existing chain works

According to the dev.to post, the current stack spans three artifacts. ads.txt is the publisher's list of authorized seller IDs. sellers. maps those IDs to real accounts at each intermediary. source.schain, attached to OpenRTB bid requests, lists the hops a given request took on its way to auction. A buyer that reconciles all three gets a usable, though incomplete, picture of who is entitled to sell a given impression.

adagents., served from the /.well-known/ path, does not slot into that chain. It names agents rather than seller IDs, and OpenRTB 2.6 provides no field identifying which agent produced a given request. The result is a fourth file that buyers must fetch and reconcile separately, because nothing in the protocol connects it to the other three.

The mismatch in practice

The post outlines several failure modes the disconnect makes possible. An AdCP or AAMP path can be listed as an authorized seller in ads.txt while being an agent the publisher never included in adagents.. The reverse also holds: an agent the publisher did list can be absent from the request's schain, or its asi entry can fail to match the agent's URL.

At auction time nothing flags the difference. The request looks like an ordinary bid request, deal IDs arrive in imp.pmp.deals, and the agent that negotiated the package is not represented as a first-class object anywhere in the payload. A buyer whose validation covers schain completeness, hop parameters and ads.txt membership will therefore accept inventory that an agent was never authorized to represent. Neither specification cross-checks the other today.

What the analysis recommends

The dev.to post closes with practical guidance for the receiving side:

• Continue reconciling source.schain against ads.txt and sellers.; the arrival of agentic buying did not retire that stack.
• Crawl adagents. for publishers already being fetched for ads.txt and store it alongside the seller list, treating a missing file as unknown rather than unauthorized until policy dictates otherwise.
• Resist inventing a schain node type for agents; SupplyChain 1.1's hp=0 custody nodes belong to a separate proposal.
• Validate the bid request actually received rather than assuming its shape.

The author also notes that RTBlint, referenced in the post, neither crawls adagents. nor certifies agents, and that a valid schain on its own is not evidence that an agent was listed. The analysis is independent of both the IAB Tech Lab and AgenticAdvertising.org.

Why it matters

Ad fraud has historically lived in the seams between trust systems, and this is a new seam. Publishers now have a way to declare which agents may sell on their behalf, but that declaration sits outside the object buyers inspect at bid time. Until the two ecosystems interoperate, either through cross-references between the files or an OpenRTB field tying a request to its producing agent, every schain validation that passes is silent on agent authorization. Buyers who want coverage have to add an extra crawl and an extra policy rule; buyers who do not will keep green-lighting impressions under a check that no longer means what it used to.