File DA-047 View as Markdown
The portal
app.doubleagent.so is where you read your data. This page tells you which screen answers which question, what each setting does, and what your team role lets you do.
Before you start: an account (Accounts) and a verified domain. Until the domain is verified, every screen of the site shows Data is being collected with a button to verify it. Nothing collected before then is lost.
Sign in with a magic link sent to your email. The link works once, for 15 minutes.
Which screen answers what
Open a site from the sites list. Its screens are in the sidebar under Analytics.
| Your question | Screen |
|---|---|
| How much of my traffic is human, bot or agent, and what are they trying to do? | Overview |
| Who is on the site right now? | Live |
| Where did visitors come from, and where do humans struggle? | Traffic |
| Which crawlers and scripts hit the site without running JavaScript? | Crawlers |
| Is anyone probing, scraping or attacking the site? | Threats |
| Which agents act on the site, for whom, and how was that proven? | Callers |
| What happened in one visit? | Sessions |
| Who keeps coming back, and what path did they take? | Visitors |
| Which named agents visited, and are they listed in the agent directory? | Agents |
| Screen | What it shows |
|---|---|
| Overview | Live now, the period's traffic by class, sessions by intent, and the named bots and agents |
| Live | Sessions on the site now, the last 24 hours by hour, and every active session. Needs live presence: on by default for test keys; for a live key add data-live="on" to the script tag |
| Traffic | Three views. Breakdowns: time on site per class, who declared themselves, where (with a globe), what they did, landing pages, profile and action. Sources: channels and campaigns (source, medium, campaign) with their human, bot and agent split, first touch. Channels follow Google Analytics 4's default channel groups (Paid Search, Organic Search, AI Assistant, Email, Referral, Direct and so on). Friction: rage, dead and error clicks, quick U-turns and pogo-sticking, per page type and path |
| Crawlers | Requests your edge reported: crawlers, scrapers and HTTP clients, whether they proved who they are, what they fetched and how the site answered. Empty until you set up edge reporting |
| Threats | Probing, scraping, credential attacks and floods over time, the most probed paths, networks and countries, and the clients behind them. On every plan. See Intent |
| Callers | One row per agent and the person it acts for: verification level, who verified it, the grant, sessions outside the grant, and intent. A row opens its sessions; a person's row exports their audit trail |
| Sessions | Every session, humans included, with filters for intent, conduct, agent, operator, channel, campaign, landing page, country and more. The Unverified traffic tab holds sessions kept out of your numbers (why) |
| Visitors | Returning visitors and each one's journey across sessions, linked by the visitor id that Visitor tracking allows |
| Agents | Named agents seen on the site, with their directory listing, reviews and registry history |
Crawlers that never run the script have no source, so they don't appear in Sources.
One session
Click a session to open its detail. The Overview tab shows:
- Verdict: human, bot or agent, and why.
- Arrived from: channel, source, referrer, entry page and its title, campaign tags, ad click, paid search term,
Likely searches (with Search Console) and Searched on site (site search).
- Visit: pages, time on site, device.
The other tabs are Journey (each page), Evidence (every reason code), Identity (agent, operator and how it was proven), Network & device, History (each report the server received) and Feedback.
On Feedback you can label the session human, bot or agent if you think the verdict is wrong. Every role can do this, Viewers included. Labels help us measure and improve detection. They don't change the live verdict.
Settings
Sites › your site › Settings has these tabs. Viewers can see them but not change them.
| Tab | What it does |
|---|---|
| General | The site's name and its profile, which sets how strict the recommendation is per action. Owners also see the danger zone: discard data collected before the claim, or delete the site |
| Site context | What kind of site it is, its industry and price level. Optional. It helps the models read behaviour in context: fifteen minutes on one sofa is normal, on one T-shirt it is hesitation |
| Visitor tracking | Whether a random id in the visitor's browser may link their visits, so you see returning visitors. Region-aware (default) asks for consent in the EU, EEA, UK and Switzerland and links visits elsewhere; Consent everywhere; Always, which needs you to confirm you have a legal basis to store the id without a banner; or Off. Opt-out signals such as Global Privacy Control always win. See Privacy and consent |
| Agent policy | The agent behaviour policy: Monitor (tag only, the default) or Enforce (a rule break changes the recommendation to deny). Permission rules allow or deny agents by catalog id (or *) and action, with limits for requests, failed sign-ins and denied actions per actor per minute. See Verdict › Conduct |
| Webhook | The Debrief webhook URL and signing secret |
| Credentials | Write-only keys for relabelling from the server: GA4 Measurement Protocol, Mixpanel, Klaviyo, Shopify and Stripe |
| Search Console | Connect Google Search Console to see likely searches on organic Google visits |
| Usage | How much this site stores |
Domains and API keys sit under This site in the sidebar. Domains is where you verify a domain. API keys is where you create, rotate and revoke keys; a secret key is shown only once. The Audit log (opened from Settings) records who changed keys, domains and settings.
Your public agents
If you added an MCP server or A2A agent, open it from the workspace switcher. Its screens are Overview, Conversations, Tasks, Counterparties, Callers, Threats, Revenue and Operations, and Setup for its ingest key and install steps. See Callers for what the caller columns mean.
Your account
- Team (account menu): invite people and set their roles.
- Usage: what the account stores against the plan, per site and agent, this cycle and past ones.
- Account settings: the account's name, billing and invoices, and closing the account.
- Approve CLI login: approve a
npx @doubleagent-so/cli loginfrom your terminal. See CLI.
| Role | Can |
|---|---|
| Owner | Everything, including managing other Owners and deleting sites |
| Admin | Add sites and change their settings, manage keys, invite and manage Admins and Viewers |
| Viewer | See every site's analytics and sessions, and label sessions. Changes nothing else |
Next: Verdict to read a session's verdict, or Site profiles to pick the right profile.