AI agents execute SEO workflows autonomously by running a five-stage loop — perceive, plan, act, verify, log — against your live infrastructure using tools (GSC API, CMS API, git) instead of a human at the keyboard. At WebFlur we ship this loop on our own domain and on client sites through an MCP + A2A stack; the rubric is what decides whether it earns trust or drifts.
What we actually watched an agent do on our own site
A mid-market DevTools company we audited in July 2026 asked a simple question: "if we hand our schema hygiene to an agent, what does it actually do on a Tuesday morning?" We built the answer on webflur.com first before pitching it. The agent — a Claude Sonnet planner, a GPT-5 executor, and a Claude Opus verifier wired together via MCP — pulled our GSC last-7-days data at 09:04, spotted three URLs whose AI-Overview citation share had dropped week-over-week, opened each page's HTML, diffed the JSON-LD against our current three-schema stack template, and filed one PR per URL by 09:11. Each PR contained the diff, the rubric score, and the linked GSC row. A human (me) merged two, rejected one for a tone slip in the FAQ answer. The rejection got fed back to the planner as a fault, the next Tuesday's run avoided the same class of miss.
That's the real shape of the workflow. Not a magic "AI does SEO" button — a boring, auditable loop that swaps ten hours of human clicking for eleven minutes of agent execution plus a rubric review. We run the same pattern on lastridefuneral.in, where 100+ agentically-refreshed pages ship on a rolling schedule — different verticals, same five stages.
Before you can trust that loop, you have to know what each stage does, who owns the tool calls, and where the kill-switch sits. That's what the rest of this piece unpacks — starting with the decision loop that every ranked competitor writing on this query skips.
Of 40 B2B sites we audited in Q3 2026 (July–September), only 6% shipped any agent-readable surface — an llms.txt, an A2A agent card, or structured schema chunking that a planner LLM could actually parse without hallucinating. The other 94% could still be crawled, but a planner would need a screen-scraping hack to plan against them. Source: internal WebFlur audit dataset, July–September 2026. Underlying methodology in our companion post on how to prepare your website for AI agents.
What does an SEO agent actually do end-to-end?
An SEO agent runs a five-stage loop: perceive → plan → act → verify → log. It pulls signals (perceive), decomposes the goal into a task tree (plan), calls a tool to change something (act), grades the change against a rubric using a second LLM (verify), and appends the diff to an audit trail (log). The loop repeats until the rubric passes or a kill-switch trips.
Each stage maps to a concrete tool call. Perceive is a GSC or GA4 API pull plus a targeted crawl of the URLs the signal fires on. Plan is a Claude or GPT planner call with the goal in the system prompt and the signal in the user turn. Act is either a git commit against the site repo, a CMS REST call, or a schema-block write via a wrapper tool that we authored ourselves so the agent can't touch anything outside <head>. Verify is a second LLM call — different model, different prompt — that grades the diff against a rubric doc we versioned in the same repo. Log is a JSONL append with the URL, the diff hash, the rubric score, and the run ID; that's the trail an auditor reads six months later.
Nothing exotic. The exotic part isn't the models — it's that the loop runs without you at the keyboard, and it keeps running as long as its tokens and its API keys hold. If you want the wider context on where this fits inside the taxonomy, our foundations pillar covers AI SEO, Agentic SEO, GEO & AEO — what they are and how they work. And if you want the copilot-vs-agent line drawn crisply, the sibling breakdown AI-assisted SEO vs agentic SEO is the piece to read next.
What is the SEO agent decision loop (with a real pseudoflow)?
The decision loop is a state machine, not a chat. Every step reads from a persistent context, writes back to it, and can fail closed — abort the run — if a guard fails. Most ranked competitors on this query describe "AI does SEO" as a list of chores. The loop below is why the chores actually ship without breaking your site.
Here's the shape we've hard-coded on our own stack, stripped to the bones an engineer can read at a glance:
while goal.not_met() and budget.remaining():
signals = perceive(gsc_api, ga4_api, crawl(url_scope))
plan = planner_llm(goal, signals, memory)
for step in plan.steps:
if not policy.allows(step): abort("policy-guard")
diff = executor_llm(step, tools=[cms_api, git, schema_writer])
score = verifier_llm(diff, rubric)
if score < threshold:
memory.append(fault=step, reason=score.notes)
break # replan next iteration
commit(diff)
log.append(url, diff.hash, score, run_id)
memory.persist()
Two things worth calling out. First, policy.allows(step) is the guard that keeps the agent inside its sandbox — no writes outside /blog/, no schema types outside the allowlist, no more than N PRs per day. Second, when the verifier fails, we don't retry blindly; we replan, because the failure usually means the planner misread the signal. Anthropic's building effective agents guide makes the same point at protocol level: verifier-gated retries beat blind retries every time.
What are examples of agentic SEO workflows that actually work?
Four workflows we've shipped and re-shipped without regret. Each one is narrow — a single chore with a single rubric — because narrow chores are where verifier LLMs stay honest. The moment you ask one loop to "do all my SEO", drift arrives within a fortnight.
- Schema audit-and-fix. Weekly sweep of every URL for missing or stale JSON-LD (Article, FAQPage, HowTo, BreadcrumbList). Missing block → agent files a PR with the block added, verifier grades against the schema.org spec, we merge or reject. On webflur.com this catches ~2 stale
dateModifiedfields per week. - Internal-link backfill. Nightly crawl of the sitemap flags orphan spokes (no inbound sideways link). Agent proposes 2–4 contextual anchors from the target's
anchor_text_bank, opens PRs against the source blogs. Verifier grades anchor relevance; the WebFlur graph script (check_cluster_links.py) grades topology. - Share-of-model tracking. Every Monday the agent queries ChatGPT, Perplexity, and Claude with our tracked keyword list, logs citations to a SQLite DB, and flags any query where we dropped out of the cited set week-over-week. No writes — this one's read-only, which is why it went live first.
- Programmatic-page refresh. For location pages and product-facet pages, the agent refreshes dated stats and bumps
dateModifiedon a schedule. Verifier grades the refreshed number against a source URL the agent had to fetch. LRF's ghat pages run on a variant of this.
The pattern beneath all four is the same — one signal source, one tool, one rubric, one kill-switch. If a vendor pitches you an agent that does five of these in one loop, that isn't agentic SEO; it's a demo. When we help teams evaluate stacks the WebFlur breakdown of AI SEO agencies spells out the questions that separate real loops from theatre.
How do I give an AI agent access to my site safely?
Least-privilege, sandboxed, kill-switched. That's the whole answer in three words. Never hand an agent your admin credentials, never let it write to production on its first day, always leave yourself a way to stop it in under a minute. Everything else is implementation detail.
The full 7-step handoff we run on every new agent — client-side or on our own domain — is in the next section as a numbered list, and it also ships as HowTo schema in the head of this page so an AI Overview can lift it directly. The safety checklist that follows is the pre-flight we tick before the first run.
Pre-flight safety checklist — before you hand SEO to an agent
- Read-only tool access first (GSC API, GA4 API, site read API); write access unlocked only after two weeks of clean dry-runs.
- Scoped API tokens per tool — never a single admin token; if the token leaks, blast radius is one endpoint.
- Every write action produces a PR against a staging branch, not a push against
main. - A verifier rubric committed as a versioned markdown file in the same repo as the site; changes to the rubric require a human PR too.
- A policy layer that whitelists file paths, schema types, and API endpoints the agent may touch — anything outside aborts the run.
- A per-run budget (max PRs per day, max tokens per run, max API calls per hour) with hard-fail behaviour when exceeded.
- A single kill-switch — feature flag, revocable API key, or a paused GitHub Actions workflow — that stops all agent writes in under 60 seconds.
- Structured logs (JSONL) with URL, diff hash, rubric score, run ID, and timestamp on every action; kept for at least 90 days.
- A weekly human review of the log; a monthly review of the rubric against real citation outcomes.
- A public
llms.txtand an A2A agent card so other people's agents also know how to talk to your site safely — reciprocity matters here.
The 7-step handoff protocol for putting an SEO agent on a live site
This is the numbered sequence we walk every new engagement through. It's also the sequence emitted as HowTo schema in the head of this page — so an AI Overview can extract it verbatim. Start-to-finish is roughly two weeks of clock time, with most of it spent in dry-run.
- Scope the goal in one sentence. Write the agent's job as a single business outcome — e.g. "lift non-brand impressions on procurement-software queries 30% by end of quarter". Vague goals produce vague loops.
- Pick one workflow, not five. Start with schema audit-and-fix, internal-link backfill, or share-of-model tracking. Multi-workflow agents multiply failure modes before you've earned trust.
- Sandbox before production. Run the agent against a staging branch or shadow domain first. Every action that would touch live HTML lands as a PR, not a push, for at least two weeks.
- Grant least-privilege tool access. Read-only GSC + GA4 first; write access to the CMS only via a scoped API token with per-endpoint permissions. Never hand it your admin credentials.
- Write the rubric before wiring the verifier. The verifier LLM grades against a rubric you can hand a human intern. If you can't write the rubric, you don't yet know what "good" looks like — pause here, don't paper over it.
- Dry-run and diff every action. The agent produces a diff of every proposed change, logs it to a JSONL audit trail, and requires the diff to pass the rubric before it merges.
- Stage the rollout with an off-switch. Start at 10% of eligible pages, monitor for one week, then step up. Keep a kill-switch — feature flag or API-key revoke — that stops all agent writes in under 60 seconds.
Step 5 is the one teams try to skip. Don't. A verifier without a rubric is a random-number generator with better packaging.
What do agents do well vs badly (and how does that decide what to hand off)?
Not every SEO chore belongs in an agent loop. Some tasks compress beautifully — mechanical, high-volume, rubric-gradable. Others still need a human because the rubric can't be written or the failure cost is catastrophic. The table below is the sort we run on our own backlog before deciding which chore to automate next.
| SEO task | Agent does well? | Why |
|---|---|---|
| Schema JSON-LD audit + fix | Yes — ship it. | schema.org spec is the rubric. No judgement calls. |
| Internal-link backfill | Yes — with a topology grader. | Anchor-text bank + graph script give a hard rubric. |
| Share-of-model tracking | Yes — read-only. | Zero write risk. Cheap first win. |
| Title-tag / meta rewrite | Yes — with brand-voice rubric. | Mechanical, but drift risk without a strict rubric. |
| Full blog draft | Sometimes — narrow verticals only. | Voice, POV, first-hand experience are hard to verify. |
| YMYL claims (medical / legal / financial) | No — keep a human. | False-negatives are materially expensive. Verifier LLMs still miss nuance. |
| Strategic cluster planning | No. | Requires vertical judgement the agent doesn't have. |
Rule of thumb: automate the chores where a rubric fits on a whiteboard, and keep the rest. That's the healthy shape most B2B teams land on — one or two narrow agent loops plus a human for the strategy layer. Full automation isn't the finish line; it's a delivery choice you earn into.
Every ranked "AI does SEO" article we found on this query stops at the chore list. None of them show the loop. The loop is the answer — perceive, plan, act, verify, log — because it's what makes the chore list safe to hand off. Skip the loop and you don't have autonomy; you have a very confident intern with your admin password.
- Anthropic — Building effective agents — the engineering guide that codified planner/executor/verifier as a protocol, not a metaphor.
- Model Context Protocol specification — the open protocol our agents use for tool access; the reason a Claude planner can call a GSC executor without a bespoke wrapper.
- Agent2Agent (A2A) Protocol — the open protocol for agent-to-agent handoff; how our A2A endpoint at
/a2a/v1lets other people's agents plan against WebFlur without scraping. - github.com/a2aproject — reference implementations of the A2A skills format and agent card spec.
- OpenAI — Introducing ChatGPT Agent — vendor announcement, July 2025 — the release that made general-purpose executor agents cheap to rent.
- Google Search Central — Article structured data — the spec our schema-audit agent grades against.