Skip to content
Responsible use

robots.txt, service rules, and authorization for automation

The Robots Exclusion Protocol communicates an owner's crawling preferences, but the standard explicitly says it is neither authorization nor access control.

2 min readReviewed and updated: August 6, 2026

Key points in one minute

  • Authorization comes from contracts, service rules, and an agreed scope.
  • Ambiguity should default to no action until clarified.
  • A redirect to a new domain requires a fresh scope check.
  • The robots.txt version belongs in run-specific evidence.

The role of robots.txt

The file expresses Allow and Disallow rules for crawler user agents and can reduce unwanted crawling. Listing a path does not make it private.

A parser should fetch robots.txt from the standard path, process status codes, redirects, encoding, and the most specific matching rule. Cache rules for a bounded period and refresh them on schedule. Even an Allow rule does not replace a site's terms: it governs crawler behavior, not commercial rights to data.

Written scope

Testing and automation scope should list domains, IP ranges, methods, time windows, rate limits, approved accounts, and prohibited actions.

Store scope in a machine-verifiable form: exact FQDNs, methods, paths, accounts, windows, maximum rate, and authorization expiry. Allow wildcards only after separate approval. If a redirect reaches another domain, automation must stop until the new destination is confirmed in scope.

Stop conditions

A 429, explicit denial, rising errors, unexpected authentication, or a scope boundary crossing should stop the workflow for human review.

Make stop conditions technical: 5xx rate, 429, unexpected 401 or 403, latency increase, API schema change, or an out-of-list path. Stopping should preserve a checkpoint and reason without automatically switching IP. A responsible operator resumes only after owner confirmation or correction of an internal error.

Execution audit

Every run should link to an owner, task version, time window, and outcome. This supports scope evidence and incident investigation.

Create a run ID for each cycle and retain the scope, robots.txt, software, and rate-limit versions plus aggregate request counts and outcome. Do not keep fetched content beyond its purpose. In a dispute, the log should prove the system validated boundaries before each request rather than attempting a prohibited resource.

Practical checklist

  1. 1Obtain resource-owner approval.
  2. 2Record allowed targets and methods.
  3. 3Implement automatic stop conditions.
  4. 4Store the scope and rule version for every run ID.
  5. 5Stop redirects to domains outside the approved list.

Sources and documentation

This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.

This material is for general information only. Requirements should be checked against the current law and, when needed, with a qualified specialist. It is not individual legal advice.

  1. 1.RFC Editor / IETF: RFC 9309: Robots Exclusion Protocol
  2. 2.OWASP Foundation: APTS Scope Enforcement
  3. 3.Президент России: Федеральный закон от 27.07.2006 № 149-ФЗ «Об информации, информационных технологиях и о защите информации»

Continue reading

More articles on related topics

Personal data

Personal-data minimization in a proxy service

Read

Legal foundations

Privacy notice, consent, and contract: different legal bases

Read

Infrastructure and law

Data localization and cross-border transfers: mapping the route

Read