Does the plugin let agents write to my site?

The core contract is read-only. One optional extension, request_expert_call, is a private contact-form submission: it never edits, publishes or deletes anything, is rate-limited, rejects secret-like payloads, and stays hidden until you configure it.

What can I exclude?

Post types, individual paths, WooCommerce transactional pages (cart, checkout, account – excluded automatically), drafts, protected and password posts are never exposed.

Why structuredContent?

Agents get typed JSON they can validate, not a string of Markdown to re-parse. Text results are kept for compatibility.

Can I see what agents did?

Opt-in audit log: timestamp, tool, argument fingerprint, hashed IP prefix, status, duration. No raw arguments, no personal data.

Is the contract hash a security proof?

No. It proves the same contract is deployed across stacks – identity, not safety. Safety comes from bounded schemas, owner toggles and fail-closed defaults.