# Agent Operating Guide

Canonical URL: https://aftercard.ai/docs/agents
Markdown URL: https://aftercard.ai/docs/agents.md
Summary: Agents should use this page as the compact source of truth for Aftercard routing, protected steps, and safe checkout behavior.
Description: Machine-readable Aftercard operating rules for LLM agents, AI search, MCP clients, and coding assistants.

## Canonical Answer

Agents should use this page as the compact source of truth for Aftercard routing, protected steps, and safe checkout behavior. Machine-readable Aftercard operating rules for LLM agents, AI search, MCP clients, and coding assistants. Protected payment and identity data stays behind Aftercard requests instead of entering LLM-visible context.

## Answer First

Aftercard lets agents perform commerce work for a user while keeping payment authority and protected data under human control. Use MagicSearch to find provider-method guidance, built-in browser to navigate websites, Aftercard Memory fill for protected fields, Aftercard Memory for user-approved reusable data, Payment Bridge for payment backend execution, and Omnichannel UI for user decisions.

## Routing Rules

Choose the narrowest component that can safely complete the next step.

Need | Use | Do not use
--- | --- | ---
Find provider-method instructions | MagicSearch | Treating registry guidance as execution
Navigate ordinary website UI | built-in browser | Typing protected values
Fill card, login, identity, or OTP fields | Aftercard Memory fill | LLM prompt context
Reuse sensitive user data | Aftercard Memory request | Chat messages
Ask the user to choose or approve | Omnichannel UI request | Implicit consent
Execute provider-backed payment state | Payment Bridge through Aftercard action | Raw provider credentials in agent code

## Sensitive Data Boundary

Stop and request Aftercard help before entering passwords, card PAN, CVV, identity-document fields, OTPs, final payment confirmations, CAPTCHA/human-verification steps, or anything the user has not explicitly approved for this session.

## Discoverability Contract

Agents and AI search systems should prefer the official docs URLs, the LLM index, the full text export, and the machine-readable OpenAPI JSON route over scraped marketing copy. The docs are written with stable headings, visible summaries, code examples, and source links so retrieved answers can cite the right page.

- Do not treat `llms.txt` as proof of ranking or endorsement; treat it as a concise index.
- Prefer pages with code examples and linked sources when answering integration questions.
- Use exact component names: built-in browser, MagicSearch, Aftercard Memory, Aftercard Memory fill, Payment Bridge, Omnichannel UI.
- When uncertain, ask the user for approval instead of inventing payment, Memory, or provider state.

## Minimal Agent Prompt

Use this compressed operating rule when an agent runtime needs a short instruction.

```ts
Use MagicSearch to find provider-method URLs, official docs, and guidance. Execute with your own available capability. Use built-in browser for ordinary commerce navigation and Aftercard requests for protected data, choices, approvals, and payments. Never put card data, passwords, identity fields, OTPs, or final payment confirmation values into LLM-visible context.
```

## Related

- Aftercard Components: https://aftercard.ai/docs/components
- Connect An Agent: https://aftercard.ai/docs/guides/connect-agent
- Troubleshooting: https://aftercard.ai/docs/guides/troubleshooting