Progressive Agent Access lets one user intent move from static discovery to richer agent workflows only when the client proves capability and permission.
Same action across tiers
- Minimal Access: return a public URL and a code only. No state changes.
- GET-Action fallback: allow a bounded idempotent URL action only when consent, rate limits, audit logging, and no-secret query rules hold.
- POST JSON: prefer structured POST for L2+ clients, rich validation, authentication, and normal API behavior.
- Advanced manifests: expose schemas, examples, discovery manifests, conformance records, and evidence packets.
- Memory or handoff: move durable claims through Project Handoff, Agent File Handoff, review receipts, and final-report evidence.
Failure behavior
- If the client cannot prove capability, return the lower-capability public URL.
- If the action needs consent, return a human-review URL or blocker record.
- If the request carries secrets or private identifiers in a query string, reject it and require a safer POST or human-mediated path.