In development

Nothing happens until you say yes.

Verifier is the gate between an agent and your business. You approve each action, set the limits, and see every attempt.

In development. Nothing executes against a real business today. The rule is already enforced in code as a refusal, but there is no verification flow yet for an owner to use.

How verification worksSee the roadmap

01Why it matters

Letting a machine book your work is a trust decision, not a software one.

So no action can run until the owner has verified that action type, and every one that does run is logged, attributed and notified.

One job, twice

Watch an agent lose a job, then win the same one.

Same customer, same request, same plumber. On the left, the site as fifteen of fifteen sites stand today. On the right, the same site latched.

Booking attempt · unlatched

<sydney-plumber>.com.au

  1. CustomerBook me a plumber in Marrickville for Thursday morning. Blocked kitchen drain.
  2. AgentSearching. Four Sydney plumbers. Trying the first.
  3. AgentGET https://<sydney-plumber>.com.au/200 OKsucceeded
  4. AgentGET /.well-known/ai-catalog.json404. No ARD catalog. True of 15 of the 15 sites scanned.blocked
  5. AgentReading navigator.modelContextundefined. No WebMCP declaration. 15 of 15.blocked
  6. AgentLooking for an MCP endpointNone advertised. 15 of 15.blocked
  7. AgentFalling back to the page. Rendering.in progress
  8. WebsiteContact form found on /contact-us/. Five fields.Not in the fetched HTML. Only a browser gets this far.
  9. AgentFilling name, email, phone, suburb, job descriptionEvery value accepted by the site's own validation.succeeded
  10. WebsiteRequired field: g-recaptcha-responseCAPTCHA sits on 4 of the 5 scanned sites that have a real form.blocked
  11. AgentI cannot complete a CAPTCHA. I do not try.blocked
  12. AgentFalling back to the phone number: tel:+61 2 ....8 of 15 sites offer an agent nothing else.blocked
  13. AgentI cannot make phone calls.blocked
  14. ResultNo booking. The agent hands the customer a phone number and stops.blocked

blocked

Zero actions completed. The job goes to whoever answers next, and nothing on the site recorded that anybody tried.

Composed from the 25 August scan and the 26 August browser run over fifteen Sydney service sites. Every blocker in it is one we hit, and every count is in the artefacts below. The business is not named: these defects belong to the web, not to one plumber.

Booking attempt · latched

<sydney-plumber>.com.au

  1. CustomerBook me a plumber in Marrickville for Thursday morning. Blocked kitchen drain.
  2. AgentGET /.well-known/ai-catalog.json200 OK. One catalog entry, published and kept current by Frontlatch.succeeded
  3. AgentConnecting to the hosted MCP endpointThree tools: check_availability, request_quote, book_job.succeeded
  4. Agentcheck_availability(service: "blocked-drain", date: "2026-09-03")Three windows returned.succeeded
  5. Frontlatchbook_job was verified by the owner on 25 Aug. Agent identity signed. Request is inside the limits the owner set.No action fires without that verification. Sandbox is the default everywhere.succeeded
  6. Agentbook_job(window: "Thu 08:00 to 10:00", suburb: "Marrickville", contact: ...)in progress
  7. FrontlatchRouted into the booking software the business already runs.Native integration first. Email or webhook where there is no integration.succeeded
  8. WebsiteJob created. Owner notified.succeeded
  9. AgentBooked. Thursday, 8 to 10am. Confirmation sent to you.succeeded
  10. ResultOne verified completed action. That is the only thing Frontlatch charges for.succeeded

succeeded

One booking, logged, attributed to a signed agent identity, and in the owner's inbox before the customer put the phone down.

Not a recording. This is the flow specified in docs/03, and it is not live: the hosted layer is Phase 1 and the write path is Phase 2. No site is running it, and Frontlatch has no customers.

02How it works

  1. 01

    Tested first

    Each mapped action runs in a sandbox before it is ever offered to you.

  2. 02

    You set the terms

    Approve the action, set your hours, cap the volume, choose which fields an agent may fill.

  3. 03

    You see everything

    Every attempt logged and notified in real time, and replayable afterwards.

03In detail

The trust invariant, as a state table

What happens for each combination of action type, owner verification and the limits the owner set.
ActionVerified by the owner?What happens
AnyNoRefused. Sandbox is the default everywhere.
Verified typeYes, but outside the limits setRefused, logged, and the owner is notified.
Verified typeYes, inside the limits setRuns, logged, attributed to a signed agent identity, owner notified.

The first row is enforced in code today. The second and third describe the flow being built.

04Evidence and limits

5,449

Outbound requests audited across fifteen businesses we have never spoken to. None carried a value we typed.

Source: packages/mapper/benchmark/outbound/ · 26 Aug 2026

The gate comes before the booking.

Verifier is not open yet. Start with what an agent can already do with your site, and decide about the rest later.

Scan your site, opens your email clientHow verification works