{"rule_id":"AB-058","category":"bot_auth","icon":"✍️","title":"Bot Signatures Directory","short_description":"Your site has a directory of bot signatures for verifying AI agent identities.","user_value":"A signatures directory lets you verify which bot is making a request, enabling trust-based access control.","wrong_example":"No signatures directory. You can't tell which bot is calling your API.","right_example":"A signatures directory lets you identify and trust specific bots.","effort_hint":"complex","estimated_cost":"$100+","severity":"medium","pillar":"executability","version":"1.0.0","counted_in_score":false,"check":{"type":"http_fetch","sources":["bot-auth"],"target":"/.well-known/http-message-signatures-directory"},"fix":{"eligible":false,"type":"assisted","note":"Publish signatures directory per RFC 9421"},"checklist_anchor":"#AB-058","checklist_url":"/agent-readiness-checklist#AB-058","html_url":"/rules/AB-058","json_url":"/rules/AB-058.json","related_rules":[{"rule_id":"AB-023","title":"MCP Auth Discovery","category":"bot_auth"},{"rule_id":"AB-059","title":"Bot Directory Members","category":"bot_auth"},{"rule_id":"AB-060","title":"Bot Public Keys","category":"bot_auth"},{"rule_id":"AB-063","title":"Protected Resource Metadata","category":"bot_auth"},{"rule_id":"AB-067","title":"Web Bot Auth Directory","category":"bot_auth"},{"rule_id":"AB-128","title":"OAuth2 preferred over static API keys","category":"bot_auth"},{"rule_id":"AB-129","title":"Credentials via headers not query params","category":"bot_auth"},{"rule_id":"AB-130","title":"OAuth scopes defined","category":"bot_auth"},{"rule_id":"AB-131","title":"Token revocation endpoint available","category":"bot_auth"},{"rule_id":"AB-132","title":"Token introspection supported","category":"bot_auth"}]}