TL;DR — “Agent-readable trust signals” quietly collapses two very different things — the signals you emit about yourself in machine-readable markup, and the signals a machine reads about you from sources it already trusts. The industry sells the first: schema, author credentials, verifiable badges, a review widget on your own site. A machine treats almost all of that as evidence of who you are, not proof that you are any good, because it is cheap for anyone — including an impostor — to emit. Credibility follows the oldest rule in signalling: a signal is believed in proportion to how costly it is to fake. Self-declared markup is cheap, so it buys legibility, not trust; the signals that move whether a machine recommends you all live off your own domain and are expensive to obtain. Get legible first — you cannot be chosen if you cannot be resolved — then spend where it counts: on the third-party corroboration you do not control. A Trustpilot study of 800,000 AI answers found brands with no independent review profile were cited about 1% of the time and brands that actively earned reviews about 75%. No amount of JSON-LD moves a number like that.
The phrase hides two different things
Search for “agent-readable trust signals” and you will be handed a checklist: add Organization and Author schema, mark up your credentials, wire in an AggregateRating, publish a verifiable badge or two, and the machines will judge you credible. It is a tidy story, and it is selling a category error. The phrase runs two categories together as if they were one.
The first category is the set of signals you emit — structured data, author markup, on-site bios, first-party testimonials, self-issued credentials. A machine can read them, which is why they get filed under “agent-readable.” The second category is the set of signals a machine reads about you, from sources it already trusts — third-party reviews, editorial coverage, analyst mentions, the open-web consensus that resolves you as an entity, the sheer volume of people searching your name. Both are machine-readable. They are not remotely the same kind of evidence, and a model that judges credibility knows the difference even when the checklist pretends it does not.
What are agent-readable trust signals?
They are any credibility cue a machine can parse when it decides whether to trust and cite a source — but they divide sharply into declared signals, which you publish about yourself in a format an agent can read, and derived signals, which the machine reconstructs from what independent, already-trusted sources say about you. Declared signals establish who you are. Derived signals establish whether you are believed. Confusing the two is the most common and most expensive mistake in the field right now.
The signal you emit versus the signal earned about you
The tell that a machine already separates them is what it does when a declared signal is unsupported. Add a five-star AggregateRating to a page with no visible reviews and you do not get a credibility boost; ResoLLM’s 2026 testing found this is one of the fastest ways to erode a model’s trust in your whole domain, because retrieval systems cross-reference the marked-up claim against the page and against the wider web, and a mismatch reads as a distrust signal that contaminates the rest of your schema. A number you assert about yourself is not taken at face value. It is checked against sources you do not control — which is the entire game in miniature. The technical foundation of structured data matters enormously for being understood; it does very little for being believed.
Take one claim — “the leading supply-chain consultancy for UK manufacturers” — and watch it change value with its source. On your own About page, marked up in Organization schema, it is a declared signal: a machine reads it as “this firm describes itself as leading,” files it under identity, and moves on. In an analyst’s ranking, a trade journal’s feature, or a pattern of independent reviews all saying the same thing, it is a derived signal: the machine reads it as “trusted sources treat this firm as leading,” and that is what tips a recommendation. Identical words. The entire difference is who is doing the saying, and whether it cost them anything to say it.
Why a machine discounts what you say about yourself
There is a clean reason a model weights declared and derived signals so differently, and it is older than the web. Any receiver of a signal in a market with asymmetric information faces the same problem: the sender knows their own quality and has every incentive to overstate it. The economist Michael Spence won a Nobel for the resolution — a signal only separates good senders from bad ones if it is costly to fake. A qualification means something because a weak candidate could not have obtained it. A signal that anyone can emit for free carries no information, so a rational receiver ignores it.
A language model deciding whether to cite you is exactly that receiver. It cannot phone your references. It has your self-description and it has the traces you have left across the web, and it has learned — from the training corpus and from the retrieval layer’s ranking — to discount the former and lean on the latter. Not because it is suspicious of you specifically, but because self-assertion is cheap for everyone, honest and dishonest alike, so it cannot carry weight. The machine’s credibility discount tracks fake-cost almost mechanically: the cheaper a signal is for you to produce about yourself, the less it moves the model’s judgement.
This is not the model being cynical; it is the model being calibrated. When Stanford’s 2026 AI Index looked at how systems select sources, the pattern was a machine translation of Google’s old E-E-A-T idea — experience, expertise, authoritativeness, trust — but with verification doing the heavy lifting: content backed by domain-level trust signals performed on the order of 67% better in AI citations, and those trust signals were overwhelmingly things the model could check against the wider web rather than take on the page’s word. The model is not asking “did you claim expertise?” It is asking “did anyone it trusts confirm it?” That question is answerable only with derived signals, which is why they carry the weight.
This reframes the whole checklist. Organization schema costs minutes and anyone can write it; a body of independent reviews costs years of actually serving customers well and cannot be conjured by a Friday deadline. The first tells the machine what you are; the second tells it whether you are any good. Only the costly one is evidence.
Does schema markup make a brand more credible to AI?
No — it makes a brand legible, which is necessary but different. Schema helps a machine understand and classify you: resolve your identity, place you in a category, extract your claims cleanly. It does not, on its own, convince a model you are worth recommending over a rival. The most direct evidence is a Trustpilot analysis of more than 800,000 AI answers across ChatGPT, Gemini, Perplexity and Google’s AI Mode: brands with no active third-party review profile were cited in roughly 1% of relevant answers, while brands that actively collected and responded to reviews were cited in roughly 75% — and review and trust platforms accounted for around 14% of all citations in the sample. No configuration of JSON-LD produces a seventy-fold gap. Independent verification does. A separate 2026 read of the same shift put it bluntly: models trust established news, analyst reports and verified peer reviews on the order of ten times more than a self-published corporate blog saying the same thing.
Key takeaway. Declared signals answer “who is this?” Derived signals answer “should I trust it?” A machine will happily use your markup to identify and quote you, then decide whether to recommend you on evidence that lives entirely off your domain. Optimising the part you control feels productive precisely because it is easy — which is the reason it is not the lever.
The Costly-Signal Ledger
The instrument that keeps this straight is a ledger that sorts every “trust signal” you might invest in by the one property that predicts its weight: how costly it is for you to fake. Read down the cost-to-fake column and the machine’s verdict falls out of it. Everything cheap resolves to legibility. Everything that moves credibility is costly, and — not by coincidence — sits on a surface you do not own.
| Trust signal | Emitted by | Cost to fake | What the machine treats it as |
| DECLARED — you publish it about yourself; the agent parses it | |||
| Organization / Author schema | You, on your site | Trivial — minutes | Identity and classification — legibility, not credibility |
| HTTPS, clean markup, fast pages | You | Trivial | Basic eligibility hygiene — legibility |
| On-site bios and credential claims | You | Trivial | An assertion of expertise — discounted until corroborated |
| First-party testimonials on your domain | You (curated) | Low | Self-selected praise — heavily discounted |
| Self-issued verifiable credential / badge | You | Low | Proof you said it, not that it is deserved — legibility |
| DERIVED — trusted third parties say it about you; the agent reconstructs it | |||
| Third-party reviews (Trustpilot, G2) | Your customers, off-site | High | Independent verification — credibility |
| Editorial and news coverage | Journalists | High | A trusted source vouching for you — credibility |
| Analyst / institutional recognition | Analysts, bodies | Very high | Endorsement that carries its own authority — credibility |
| Knowledge-graph / encyclopaedic entity | The open web | Very high | Consensus identity — credibility and durability |
| Independent citations across many sites | Other authors | High | Corroboration — the core of the trust judgement |
| Brand search volume | The public | Very high | Demand as proof of standing — the strongest single predictor |
The Costly-Signal Ledger. The dividing line is not “on-page versus off-page” — it is who paid to produce the signal. If you did, and cheaply, the machine reads identity. If someone else did, at cost, the machine reads trust.
Reading the ledger: the comfortable column and the costly column
The declared column is where most “AI trust” budgets go, because it is legible, fast, and entirely within your control — you can complete it in a sprint and screenshot the result. The derived column is slow, partly outside your control, and never quite finished. That asymmetry of comfort is exactly why teams over-invest in the column that does not move selection. It is worth being precise about what the comfortable column does earn, because it is not nothing: cleaner extraction, reliable entity resolution, correct categorisation. Those are real, and we will give them their due. But they are the price of being considered, not of being chosen among rivals.
The derived column, meanwhile, is where the outcome data concentrates. Muck Rack’s May 2026 study of more than 25 million AI citations found roughly 84% were earned — third-party mentions and coverage — against 0.3% from paid placement; the machine’s reading of trust is overwhelmingly a reading of what others say. Positive third-party sentiment tracked with about a 28% lift in AI visibility in Ahrefs’s data. Digital Bloom’s 2025 research found brands present across four or more independent platforms were about 2.8 times as likely to be cited as single-platform brands, and content carrying genuinely original statistics saw 30–40% higher visibility in model answers — because original data is corroboration a rival cannot reproduce. One 2026 audit of AI Overview citations found roughly 96% came from sources carrying verifiable, third-party trust signals; the remaining 4% was closer to noise than to a strategy. None of those numbers has a schema field that produces it.
Legibility is necessary — and the order matters
None of this means the declared column is optional. It is a gate. A machine that cannot resolve who you are cannot consider you at all, however strong your reputation; an entity it cannot parse is an entity it cannot cite. Structured data, a coherent Organization record, consistent identity across the web, an answer written so a retrieval system can lift it cleanly — these are the conditions of candidacy. Skip them and your derived signals have nowhere to attach. This is the same lesson the access layer and the grounding layer teach from their own angles: an agent has to be able to reach you, understand you, and represent you accurately before any question of trust arises. Legibility, reachability and fidelity are three gates in front of one prize.
The sequence: be legible, then be corroborated
So the correct reading of the ledger is not “declared is worthless.” It is declared then derived — a sequence, not a choice. Get legible once, to a good-enough standard, and stop; the declared column saturates quickly and there is no prize for a fourteenth schema type. Then move every remaining pound to the column that compounds. The firm that gets this wrong is not the one that does its markup — it is the one that stops at its markup and waits for credibility to arrive, because credibility does not live there.
For example: a mid-market software vendor can mark up every page flawlessly, publish a polished author-credential graph, and stand up an on-site review carousel — and remain uncited on “best tool for X,” because when the model reaches for corroboration it finds the vendor’s claims echoed nowhere it trusts. It is perfectly resolvable and perfectly ignored. The markup did its job; the job was never credibility.
It also helps to see how a machine assembles a derived judgement, because it explains why consistency matters as much as volume. A model does not weigh a single review or mention in isolation; it looks for a coherent, verifiable story about you echoed across trusted sources — the same specialism, the same claims, the same category, repeated by parties that do not answer to you. Agreement across independent sources reads as signal; contradiction reads as risk. This is why a marked-up claim the wider web does not support actively hurts, and why scattered, off-topic coverage underperforms a tight, consistent body of corroboration. The machine is not merely counting mentions. It is checking whether the world agrees with you.
Key takeaway. Treat legibility as a one-time gate you clear and leave behind, not a dial you keep turning. Every hour spent polishing declared signals past “good enough” is an hour not spent earning the derived signals that actually decide selection.
The Forgery Test
The ledger sorts signals in the abstract; the Forgery Test audits your own spend in the concrete. Take any line item in your “AI trust” budget and put it to three questions.
1. The impostor question. Could a well-funded impostor emit this exact signal about themselves by the end of the week? If yes, it is a legibility signal — useful for being understood, close to worthless for being trusted, because the machine cannot use it to tell you apart from the impostor.
2. The ownership question. Does the signal live on a surface you control? If it sits on your own domain, your own carousel, your own badge, it is self-interested by construction and the model discounts it accordingly. Signals that count are hosted by someone with no stake in flattering you.
3. The persistence question. Would the signal survive if you stopped paying for or publishing it tomorrow? Declared signals evaporate the moment you stop maintaining them. Earned corroboration persists, because it is other people’s content about you — which is also why it keeps working while you sleep.
Any “yes” to the first two, or “no” to the third, means you are funding legibility and calling it trust. Run the test across a real budget and the pattern is stark: the line items that pass — the ones a rival could not simply copy, that live off your domain, that persist without you — are almost always the smallest share of the spend and the largest share of the effect.
Running the test on a live budget
A team proudly lists its trust programme: schema overhaul, an author-E-E-A-T project, a testimonials page redesign, a verifiable-badge integration, and a modest digital-PR and earned-mentions line. Four of the five fail the impostor question outright — a competitor could reproduce every one within days. Only the earned-mentions line, the smallest number on the page, survives all three questions. The test does not say the other four are useless; it says they are mislabelled, and that the budget is inverted. The fix is rarely to cut the declared work — it is cheap — but to stop expecting it to do a job it structurally cannot, and to reweight toward the line that passed.
Why credibility is winner-take-most
There is a second reason you cannot buy your way to machine credibility on a declared checklist, and it is about dynamics rather than fake-cost. Answer engines cite few sources — commonly two to seven per query — so citation is not a share you accumulate gradually but a slot you either hold or miss. And the mechanism that fills those slots compounds. Models exhibit what citation researchers call a Matthew effect: they preferentially reference sources that are already widely referenced, because prior citation is itself the cheapest available proxy for trust. The first source to become the corroborated answer for a topic gets cited, that citation becomes training and retrieval signal, and the next model is even more confident in the same choice.
Why does being cited second win almost nothing?
Because citation is not proportional to merit; it is path-dependent. Once a model has locked onto a preferred source for a query, the runner-up does not collect half the citations — it often collects almost none, because the model’s confidence in its established choice keeps growing and the marginal reason to switch keeps shrinking. This is why derived corroboration is worth racing for and declared markup is not: markup you can add at any time to the same effect, but entity-lock is claimed early and defended by compounding. AirOps found only about 30% of brands stayed visible from one query run to the next, and just 20% held presence across five consecutive runs — the unlocked positions churn while the locked ones entrench.
The stakes of that path-dependence are high because the slots are so few. When an engine cites two to seven sources and a large share of buyers never look past the synthesised answer, missing the slot is closer to invisibility than to a lower ranking — in B2B, where an estimated 89% of buyers now begin in an AI answer, being uncited is being unseen. For example: in category after category a single brand becomes the reflexive answer — the one a model names when asked for “the best” without being asked for a list — and challengers discover that out-marking-up the incumbent on schema changes nothing, because the incumbent’s lead is not a markup lead. It is a corroboration lead the model has been rehearsing across training runs. The only way past it is to earn enough independent corroboration to make the model reconsider, or to find the queries where no one has locked the slot yet and claim those first.
Key takeaway. The declared column is available to everyone at any time, so it can never separate you from a rival — it raises the floor for the whole field. Only the derived column compounds, and it compounds fastest for whoever earns the entity-lock first. Credibility is a race with a memory, not a checklist with a deadline.
A worked example: Harwell & Vane
Harwell & Vane is an invented firm, built to be specific: a UK management consultancy of about £40m in fee income, known in a narrow lane — operations and supply-chain transformation for mid-market manufacturers. A consultancy is the cleanest possible test of the argument because it sells nothing but credibility; there is no product spec to hide behind. Its board wants Harwell & Vane to be the name an executive’s assistant-agent returns for “best UK consultancy for supply-chain transformation, mid-market,” and has approved a £150,000 programme for the year. Two roads out of the same budget.
The naive road is a “trust-signal optimisation” sprint, because it is legible and fast: a full schema and entity build, an author-credential graph for every partner, a rebuilt case-studies section, a verifiable-badge integration, and a review widget on the site. Roughly £110,000 of declared work, £25,000 of content, £15,000 held back. The ledger road spends £25,000 clearing the legibility gate properly and then stops there, and puts the remaining £125,000 into the derived column: getting partners quoted in trade and national press, earning independent reviews on the platforms buyers actually consult, pursuing analyst and industry-body recognition, publishing genuinely original supply-chain data that others cite, and building the branded demand that shows up as search volume.
| Month | Naive road: the trust-signal sprint | Ledger road: legible, then corroborated |
| Month 0 | Audit finds the site under-marked-up and treats that as the problem. Commissions the full declared build. Feels like decisive, measurable progress. | Audit runs the Forgery Test on the plan: four of five line items fail. Diagnoses the real gap as absent third-party corroboration, not missing markup. |
| Months 1–2 | Schema, credentials, badges and the review widget ship. Dashboards fill with green. The entity is now cleanly resolvable — a genuine gain, quietly mistaken for the whole job. | Legibility gate cleared in weeks for £25k. The rest of the budget starts slow, unglamorous work: pitching journalists, seeding reviews, briefing analysts, packaging original data. |
| Month 3 | Citation share on the target query is unmoved. The rival that owns the entity-lock is still the name returned. Internally: “the AI just doesn’t know us yet.” | First independent coverage and reviews land. The model begins corroborating Harwell & Vane from sources it trusts. Not yet the default, but now in the candidate set on more engines. |
| Month 6 | Concludes “AI doesn’t work for consultancies” and asks for more markup. The declared column was maxed at Month 2; there was never more to get from it. | Named in answers where no incumbent had locked the slot, displacing on the margins where it earned the corroboration. The derived signals keep compounding at no further cost. |
Harwell & Vane (illustrative). Identical budget, identical starting facts. The naive road buys a resolvable identity and calls it credibility; the ledger road buys the same identity for a fraction, then buys the thing that actually gets recommended.
Note what the naive road got right: it did need the markup, and its entity is now correctly resolved — that was never wasted. Its error was one of expectation and proportion, spending £110,000 and six months’ patience on a gate it could have cleared for £25,000, and treating a solved legibility problem as a solved credibility problem. The ledger road is not cleverer about markup. It is honest about what markup buys.
Where this argument could be wrong
The strongest objection is not hand-waving; it is data. A wave of 2026 testing shows that declared moves lift AI citations measurably. Stacking Article, FAQPage and HowTo schema produced about 1.8 times the citations of a single schema type in one OptimizeGEO test. AuthorityTech’s analysis found pairing a statistic with a named source lifted citation likelihood by around 30.6%, inline citations to authoritative references by 27.5%, and simply citing your own sources by roughly 40%; answer-first structure mattered too, with 44.2% of citations drawn from the first 30% of a page. If self-published, on-page, machine-readable moves do all that, how can declared signals be “near-zero credibility”?
Concede it fully, then look at what those numbers measure. Every one of them is a lift in citation given that the query already reached you — they measure how cleanly a model can parse, verify and quote a source it is already considering. That is legibility and extractability doing exactly the job the ledger credits them with, and you should capture all of it. What none of those studies isolates is whether the signal made the model trust you over a rival. The measures that do isolate standing point the other way: brand search volume shows the strongest single correlation with AI citation in the large studies — about 0.334 in Ahrefs’s 75,000-brand analysis, corroborated as the top predictor across Previsible’s 1.96 million sessions — and brand mentions correlate far more strongly with citation (around 0.664) than backlinks (0.218). Those are derived. The declared lifts are real; they are also the ceiling of the declared column.
And that ceiling has two properties the objection ignores. It is available to every rival: answer-first structure and clean schema are one search away for anyone, so they lift the whole field’s floor without separating you from it — a raised floor for everyone is table stakes, not edge. And it saturates: once your page is answer-first with clean claim-and-source pairing, more markup does nothing, while the derived column has no ceiling — corroboration keeps compounding through the Matthew effect. So the dichotomy survives its own counter-evidence. Capture the declared lift; it is cheap and it is real. Just do not mistake the ceiling of the cheap column for the credibility that only the costly one confers.
Can a brand buy its way to AI credibility?
Not directly. You can buy legibility (markup, engineering) and you can buy reach, but the derived signals that carry credibility are, by definition, other people’s independent judgements about you — the moment they are straightforwardly purchasable they stop being independent and the machine’s discount reappears. What you can do is invest to earn them: fund the work that gets you genuinely reviewed, covered, cited and searched-for. The spend is real; what it buys is the earned authority that no schema field contains.
The falsifier is worth stating, because it is approaching. If a machine-readable standard emerged that made a self-emitted trust claim genuinely costly to fake — a third party cryptographically attesting not just that you exist but that a quality claim about you is true, in a form agents could verify at scale — then a declared signal could carry derived weight, and this argument would narrow sharply. Verifiable credentials and content-provenance standards are reaching toward exactly that. But today they authenticate identity and origin — who issued a claim, that a file is unaltered — not merit. A signed credential proves you said it; it does not prove you deserved it. Until an attestation certifies desert rather than authorship, the discount on self-assertion holds, and the ledger stands. Watch that standard; it is where the line will move first.
What to do on Monday
A concrete first week, in order of leverage:
□ Run the Forgery Test on your current spend. List every “AI trust” line item and mark each against the impostor, ownership and persistence questions. Anything that fails is legibility wearing a credibility label. Expect the budget to look inverted.
□ Clear the legibility gate once, then stop. Get your entity resolved: a clean Organization record, consistent identity across the web, answer-first pages a model can lift. Reach good-enough and walk away — do not keep polishing the column that saturates.
□ Move the freed budget to the derived column. Get onto the third-party review platforms your buyers actually consult and respond there; the 1%-versus-75% gap is the highest-return move on this list.
□ Earn independent coverage and citations. Pursue the editorial, analyst and
peer-mention channels that vouch for you from surfaces you do not own — including the high-trust technical communities where a single credible mention carries real weight — and sustain the pace of earned mentions rather than doing one burst and stopping.
□ Publish something only you can. Original data or first-party research is a Tier-1 derived signal because no rival can copy it; an
original data asset others cite does more for credibility than any amount of markup, and it seeds the citations the Matthew effect then compounds.
□ Race for the entity-lock, and measure it. Check whether a rival already owns the slot for your priority query; if not, move fast, because being first compounds and being second rarely catches up. Track
cost-per-cited-query per engine and whether you are the named entity, not a generic “AI visibility” score, using your usual tooling and measurement baseline.
The machines have not made credibility mysterious; they have made it legible in the old sense of the word — readable off the traces you leave in the world, not the claims you make on your own page. The signals a machine can read about you are only as good as the sources that produced them, and the sources that count are the ones you cannot author yourself. Being genuinely worth recommending, and getting independent parties to say so where a machine can see it, is not a trick the trust layer rewards. It is the only thing it rewards. Everything else on the checklist just helps the machine find out. Which of your link and mention strategies produce corroboration a rival cannot forge is now the question that decides whether you are named at all — and, for brands competing across European markets, the answer has to hold in every language a buyer’s agent speaks.
The naive firm and the disciplined one had the identical £150,000 and the identical facts. What separated them was whether they knew that a signal you can emit about yourself and a signal a machine earns about you are not the same currency — and spent accordingly. Note, too, that none of this raised anyone’s standing through AI Overviews and organic backlinks by gaming a field; it did so by being verifiably good where an agent-driven browser could confirm it. In 2027 the trust layer reads your reputation off the web, not off your markup. Give it something true to read.
