From “can it be built” to “who pays first”: a 5W1H re-sequencing behind the access walls
Idea Vault · GeekWaedon @GeekWaedon
GeekWaedon @GeekWaedon · 2026-11-08
Core argument: the first three dossiers are not shallow — they ask the wrong question. Five hundred-plus text blocks make a solid case for “can it be built”, yet not one answers the question that matters most to a startup: who pays the first invoice, and under what conditions. More importantly, what actually changed the premises in 2026 is not model capability but access. From terms of service to network infrastructure, from platform litigation to internal vendor controls, “can we be reached” is no longer a technical assumption but a set of contractual and commercial terms that can change at any time. This overview adds two things: it writes access risk into the design premises, and uses 5W1H to re-sequence the three projects from feasibility into an order of payment.
This piece does not overturn the first three dossiers. The risk due diligence, the clause-by-clause legal mapping and the lists of refusals all stand. What it adds is one constraint on top: any external dependency can be cut off. It also replaces qualitative stop lines with numeric, triggerable conditions.
Verification date 2026-11-08. Vendor announcements, court filings, academic papers and analyst forecasts are labelled separately; conjecture is not written as fact. Every threshold here is an operating stop line this site sets for a one-person company — a self-defined estimate, not an industry benchmark.
I. The new risk: not one wall but four layers of access control
The claim that internet giants and leading model vendors have built firewalls “in the name of security” points the right way, but covers only one motive. Based on material verifiable as of 2026-11-08, the restrictions are layered, and each layer has a completely different way out.
| Layer | Public evidence and verification date | What it means for a one-person company |
|---|---|---|
| Contract layer · model terms of service | OpenAI personal terms effective 2026-01-01 prohibit automated or programmatic extraction of data or output, prohibit bypassing rate limits and protective measures, and prohibit using output to develop models competing with OpenAI; Anthropic commercial terms and the Google Gemini API additional terms carry similar restrictions (2026 clause review by Zhong Lun Law Firm). Written testimony before the US Senate Judiciary Committee on 2026-04-22 explicitly classified so-called “distillation attacks” as a breach of terms of service — a contractual violation, not theft in the strict legal sense. | Not training a model does not remove contractual risk. As soon as a workflow depends on bulk calls and turns output into a lasting asset of your own, you have to review the terms, the data processing addendum and the special clauses of an enterprise subscription one by one. |
| Infrastructure layer · CDN and bot policy | From 2025-07-01 Cloudflare denies AI crawlers by default on new domains, moving from opt-out to opt-in; on 2025-09-24 it published the Content Signals Policy and wrote it into the managed robots.txt of more than 3.8 million domains; on 2026-07-01 it split automated traffic into Search / Agent / Training and extended the controls to the free tier; its official announcement states that from 2026-09-15 new domains with ad-bearing pages block Training and Agent by default while allowing Search, and mixed-purpose crawlers are handled under the most restrictive rule that applies. | “Being crawlable” is no longer a default. Search, Agent and Training each need their own allowance; llms.txt and Content Signals are declarations and requests, not a pass. |
| Platform and judicial layer | Amazon sued Perplexity over Comet agentic shopping in 2025-11; a California district court issued a preliminary injunction in 2026-03; on 2026-08-04 the Ninth Circuit vacated it on the grounds that the agent is a tool, not a person, and the user rather than the vendor enters the platform, while making clear that it was not creating a new legal regime for agents and that platforms may still restrict access through terms of service. Amazon filed an amended complaint on 2026-09-21 and the case continues. In Reddit v Perplexity / SerpApi, most of the motion to dismiss was denied in 2026-07. | The criminal-law barrier got lower; the contractual barrier did not move. Do not build on “a court let us in” — build on “the platform can change its terms at any time”. |
| Vendor-internal and ecosystem layer | Media reports from the first half of 2026: Google restricted most employees from using Claude Code / Codex on security grounds and limited the Gemini call capacity supplied to Meta because of compute quotas; Microsoft cancelled most internal Claude Code licences; Meta restricted the use of competing tools in model development. In 2026-09 Tencent publicly described its large-model application firewall, agent security sandbox, per-action authorisation with operation logs and third-party skill supply-chain security. | MCP and the skills ecosystem are both a new distribution channel and a new review surface. Whether a third-party server can be called depends on host policy, not on whether the protocol is standard. |
First, calibrate the phrase “in the name of security”: at least four motives coexist — compute quotas (every call has a real marginal cost), data boundaries (keeping internal secrets in), asset protection (guarding against distillation and contamination of the R&D pipeline), and commercial licensing (Pay Per Crawl evolving into Pay Per Use and x402, which can price pages, datasets, APIs and even MCP tools). Attributing all four to security leads to the wrong conclusion that demonstrating compliance is enough; quotas and licensing are structural, so the only options are to route around them or pay.
One more rarely priced bias: a 2026 ACM Web Conference paper (Steinacker-Olsztyn, Gosain, Dao) found that 60.0% of reputable news sites disallow at least one AI crawler, against 9.1% of misinformation sites, with reputable sites naming 15.5 AI user agents on average; a SIGIR 2026 study of 11,500 real queries found that sites blocking Google AI crawler were significantly less likely to be retrieved by AI Overviews. In other words, what an agent can read is already a filtered, biased sample. Conversely, TollBit reported in 2026-02 that about 30% of AI bot scrapes in Q4 2025 did not comply with explicit robots.txt permissions (third-party monitoring, not a platform self-report). Being allowed and being cited are two different things; neither belongs in the default assumptions of a business plan.
In design terms this leaves three disciplines: data enters only through user-initiated exports and licensed sources with clear rights, never with scraping as the main channel; models are replaceable, with an evaluation set and two suppliers as standard; deliverables must be downloadable and verifiable offline, tied to no single agent or platform.
II. 5W1H: re-sequence three dossiers into an order of payment
5W1H is an old framework. Its value is not novelty but that it forces every cell to be filled in honestly. Reading the three dossiers through it, Who and When are essentially empty: they describe target users but not who signs and pays, and a 12-week MVP but not which week brings the first payment. Every cell below contains only statements that can be falsified.
| Dimension | Project one · PrivateGraph (relationship entities) | Project two · compliance delivery packs and machine-readable assets | Project three · resolve() and the evidence chain |
|---|---|---|---|
| What · what is actually sold | A one-off relationship mapping and referral-path audit deliverable, not a subscription app; the output is a downloadable list of referral paths with their evidence. | One source draft becomes N compliance-checked delivery packs plus a machine-readable asset (original-statistics block, structured Q&A, llms.txt entries) — not one-click publishing to platforms. | One resolve() call with an evidence chain carrying source, version, timestamp and confidence; “no such part on record” is a first-class result, not another database website. |
| Why · why now | The memory layer is crowded with products promising local-first operation and memory sovereignty; absolute privacy is now the entry ticket. What nobody stores is who can refer whom, on what grounds, and whether the referral was ever used. Extraction and merging got cheaper; channels and trust did not. | As access tightens, being crawlable loses value while licensed and owned assets gain it; AI content-labelling duties turn explicit declarations and verification of embedded metadata into a real pain point. This site 60-plus trilingual long-form articles and structured data are the zeroth test bed. | The bottleneck in industrial document AI is not extraction but parsing and resolution; a confidently wrong match costs far more than no match. Keeping evidence for every assertion fits a world where sources must be licensed. |
| Who · who pays the first invoice | Independent consultants, headhunters and industry BD people with referral needs who refuse to put relationships in the cloud. Payer and user are the same person, but demand is infrequent and hard to standardise, so validation is slowest. | Self-media publishers and small organisations with a steady publishing rhythm; this site is its own zeroth customer. The payer is the content lead, and the decision chain is shortest. | Small hardware teams, independent sourcing consultants and used-accelerator residual-value assessors. The payer is an engineering or procurement lead who must sign off on the evidence chain: the highest order value and the longest validation path. |
| When · how long until validation | For 90 days it stays a self-use tool with no commercial investment; if no one outside the founder circle asks for it by then, it is downgraded permanently. | Days 0-30: run it on this site and collect three real numbers — publish rate, false-positive rate and citation count. | Days 31-60: deliver two manual 100-500-line BOM disambiguation audit reports, billed per line; code comes after the second order. |
| Where · where it is delivered, where traffic comes from | An MCP server listening only on 127.0.0.1, not in any app store; whether it can be called is decided by the host agent, so no growth assumptions are made. | Own domain plus downloadable delivery files plus machine-readable entries an agent can cite; the audience expands from people to agents, but no single platform carries the entry point. | MCP or a simple HTTP API, starting with a manual PDF report; only licensed sources are connected, with no distributor pricing or stock. |
| How · how it is built, and the human/machine split | Small models handle extraction, deduplication and candidate entity merges; the human confirms relationships and authorises referrals, and no message is ever sent automatically. | Small models handle rewriting and checks where several answers are acceptable and errors can be contained; login, publishing and compliance declarations always stay with the human. | Small models handle extraction and candidate matching, with unit conversion as a separate step and explicitly empty attributes allowed; the human signs off on final disambiguation and arbitrates disputes. |
The most fragile cell is Who. The original stop lines in all three dossiers were abstractions like “stop if it cannot be done” — without a payer there is no way to falsify them. Once Who is filled in, the order follows validation speed × existing assets × difficulty of getting paid: project two is fastest, project three has a clear payer but no industry channel, and project one is slowest in the most crowded field. A one-person company should not push three lines in parallel.
III. A 90-day rhythm with triggerable numeric stop lines
The thresholds below are operating stop lines this site sets for a one-person company (self-defined estimates, not industry benchmarks). Each needs an observable trigger, to avoid the “let us watch it a bit longer” drift.
- Days 0-30, project two first: add original-statistics entries to llms.txt, build an AI citation monitoring sheet and turn two dossiers into compliance delivery packs. Stop line: if within 30 days the machine-readable entries are cited zero times across three mainstream assistants and no one outside the founder circle will pay for a delivery pack, project two becomes a self-use tool and product work ends.
- Days 31-60, validate the payer for project three: manually deliver two 100-500-line BOM disambiguation audit reports, billed per line. Stop line: if neither report leads to a repeat order or a referral, or if human review averages more than 3 minutes per line, stop automation work and keep the report template as material for the services page.
- Days 61-90, close out: turn repeated steps into a
resolve()prototype open only to licensed sources; project one stays a self-use MCP and is not started as a business. Overall stop line: if combined paid revenue across the three lines is below CNY 5,000 within 90 days, or there is not a single customer outside the founder circle, roll everything back to content and self-use tools, with no outside resources and no registered entity.
Valuation, user counts and coverage are deliberately absent. A one-person company validates cash flow before scale. Gartner 2026 puts the share of organisations that have actually deployed AI agents at about 17%, with more than 60% planning to do so within two years, and predicts that by the end of 2027 more than 40% of agentic AI projects will be cancelled because of escalating costs, unclear value or inadequate risk controls. That is an analyst forecast, not a settled fact — but the three reasons are exactly the traps a one-person company is most likely to fall into.
IV. Cut-off drill: what if these three routes close tomorrow
Access risk is only useful once translated into concrete actions. Ask each project what happens if supply is cut tomorrow; the answer must be switchable within a day, not “find another provider”.
- Model API unavailable or terms changed: an evaluation set, at least two interchangeable suppliers and a local small model as fallback; record model, prompt version and timestamp for every output so past conclusions can be replayed.
- Target platform blocks automated access: project two already delivers files only, with no login or publishing on the user behalf; projects one and three take data from user-initiated exports and licensed sources, not scraping.
- Upstream source demands paid licensing or sends a cease-and-desist: project three removes that source at source granularity rather than routing around it. The original dossier line — ten thousand verifiable records beat a hundred million rows of unknown provenance — holds even more strongly in a pay-per-use world.
- Four disciplines: replaceable models, licensable data, downloadable output, auditable logs. If any one fails, that step does not go into a customer promise.
- Hand to agents: research, competitor and regulatory checks, extraction and deduplication, prototypes and tests, trilingual first drafts, content rewrites and first-line support.
- Keep with humans: pricing, customer commitments, publishing, compliance declarations, signing the evidence chain and arbitrating disputes. Gartner explicitly places cases with only one correct answer, where errors carry legal or financial consequences, outside the suitable scope for agents.
- Do not invert the cost logic: a16z LLMflation observes that inference cost at a fixed capability level falls about 10× per year, with GPT-3-level capability (MMLU 42) dropping from about USD 60 per million tokens in 2021-11 to about USD 0.06 by late 2024; the original text calls its own method rough and explicitly limits the claim to fixed capability, not falling flagship prices. A local small model plus a cheap API can keep monthly inference in the tens of yuan. The real cost remains human review and customer conversations.
Summary
The three projects are really one thing: turning private or specialist knowledge that cannot be verified into verifiable entities and callable interfaces. Project one is relationship entities, project three is part entities, and project two turns both into content that people and agents can cite. A shared substrate means three lines should not be pushed in parallel.
The new access risk is not a reason to stop; it is a reason to strip anything that depends on someone else permission out of the plan: no scraping, no automated publishing, no single model vendor, no platform opening an interface. What remains — owned content, judgements a human can re-check, evidence chains with sources — is precisely what becomes more valuable the more walls go up.
One sentence to close: a feasibility report answers “can it be built”; 5W1H answers “who pays first”. Put the stop lines in numbers and the access constraints into the design, and an idea moves from dossier to business.
Back to Idea Vault · Project one PrivateGraph BP · Project two One-click distribution risk analysis · Project three Open component identity layer; related practice: component sourcing and matchmaking.
Frequently asked questions
Do the giants really put these walls up only “in the name of security”?
The direction is right, but it is not a single cause. At least four motives coexist: compute quotas (every call has a real marginal cost), data boundaries (keeping internal secrets in), asset protection (guarding against distillation and contamination of the R&D pipeline), and commercial licensing (from Pay Per Crawl to Pay Per Use and x402 pricing). Security is one public rationale, and the easiest one to address by demonstrating compliance; quotas and licensing are structural, so the only options are to route around them or pay. Treating all four layers as one security wall leads to the wrong response.
The terms prohibit distillation, and I am not training a model. Why does that affect these three projects?
It does, but not through the “competing model” clause. OpenAI personal terms effective 2026-01-01 also prohibit automated or programmatic extraction of data and output and prohibit bypassing rate limits and protective measures; Anthropic and Google carry comparable restrictions. As soon as a workflow depends on bulk calls and turns output into a lasting asset of your own, the terms, the data processing addendum and the special clauses of an enterprise subscription all need review. Written US Senate testimony on 2026-04-22 classified the distillation dispute as breach of contract, which tells you the main battlefield is contract and access control, not copyright.
If Cloudflare blocks agents by default, is building machine-readable assets for agents a waste?
The opposite — but the approach has to change. On 2026-07-01 Cloudflare split automated traffic into Search, Agent and Training, and its announcement states that from 2026-09-15 new domains with ad-bearing pages block Training and Agent while allowing Search. Being crawlable is no longer a default right, so licensing, owned channels and downloadable deliverables gain value. Three caveats: each category needs its own allowance; Content Signals and llms.txt are declarations and requests, not a pass; and being allowed is not the same as being cited. Also do not leave your own site on a deny-all default and still expect citations.
Why does Who — who pays the first invoice — matter more than technical feasibility?
Because the original stop lines in all three dossiers were abstractions like “stop if it cannot be done”. Without a payer they cannot be falsified. Filling in Who reveals three different payment structures: in project two the payer is the content lead, with the shortest decision chain and this site as the zeroth customer; in project three the payer is an engineering or procurement lead, with a high order value but a signature required on the evidence chain; in project one payer and user are the same person, with infrequent demand. The order then follows validation speed × existing assets × difficulty of getting paid, not technical difficulty.
5W1H is such a basic framework. What does it add here?
It forces every cell to be filled in honestly. Reading the three dossiers through six dimensions, What and Why are thorough and How is detailed, but Who lacks the person who signs and pays, When lacks the week the first payment arrives, and Where lacks the question of who controls the entry point. Once those three cells are filled, three projects that looked parallel fall into a natural order, and each one can be given an observable trigger. The framework does not produce insight; it exposes the empty cells.
What is the biggest hidden cost of using agents to push the projects forward?
Not inference. It is human review and customer conversations. a16z LLMflation observes that inference cost at a fixed capability level falls about 10× per year, with the original text explicitly limiting the claim to fixed capability and calling its own method rough; a local small model plus a cheap API can keep monthly inference in the tens of yuan. Gartner in 2026 predicts that by the end of 2027 more than 40% of agentic AI projects will be cancelled because of escalating costs, unclear value or inadequate risk controls — a forecast, not a settled fact. Two of those three reasons point at people: keep an evaluation set, record model, prompt version and timestamp for every output, sample for human review, keep audit logs, and never hand pricing or external commitments to an agent.