DEV Community

Aleksander Sekowski
Aleksander Sekowski

Posted on Originally published at rtblint.org

adagents.json does not audit schain. Those two trust files do not talk.

#openrtb #adtech #api #security

AAO published adagents.json so a publisher can declare which sales agents may represent its inventory. IAB Tech Lab already published ads.txt, sellers.json, and the OpenRTB SupplyChain object for who may sell that inventory. Those two questions are not the same, and the bid request still only carries one of them.

Four files, one hop

ads.txt is the publisher's list of authorized sellers. sellers.json is each intermediary's account map. source.schain is the hop list on the bid request. Buyers who reconcile those three have a working (if incomplete) picture of who is entitled to sell the impression.

adagents.json sits at /.well-known/adagents.json. It names agents, not seller IDs. An AdCP or AAMP path can be authorized as a seller in ads.txt and still be an agent the publisher never listed. The reverse is also possible: a listed agent whose hop is missing from schain, or whose asi does not match the agent URL. OpenRTB 2.6 has no field that says this request was produced by agent X.

What the bid request actually carries

The auction still looks like an ordinary bid request. Deal IDs land in imp.pmp.deals. The agent that negotiated the package is not a first-class object. If you only validate schain completeness, hp, and ads.txt membership, you will pass inventory an agentic buyer was never allowed to represent.

ads.txt            who may sell this publisher (seller IDs)
sellers.json       what those IDs mean at each intermediary
source.schain      the hops on this request
adagents.json      which agents may represent this inventory (new)

OpenRTB carries schain. It does not carry adagents.json.
Enter fullscreen mode Exit fullscreen mode

That split is why a green schain check is not an agentic authorization check. The supply chain trust stack and the AdCP explainer cover where the files sit. Neither file currently cross-checks the other in the spec.

What to do on the receive side

  • Keep reconciling source.schain against ads.txt and sellers.json. Agentic buying did not retire that stack.
  • Fetch adagents.json for publishers you already ads.txt-crawl, and store it next to the seller list. Treat a missing file as unknown, not as unauthorized, until your policy says otherwise.
  • Do not invent a schain node type for agents. SupplyChain 1.1 hp=0 custody nodes are a different proposal.
  • Validate the bid request you actually get. Paste it into the OpenRTB tester.

RTBlint does not crawl adagents.json and does not certify agents. A valid schain is not proof the agent was listed. Independent of IAB Tech Lab and of AgenticAdvertising.org.

Original: adagents.json does not audit schain

Top comments (0)