Observability

Observability concerns a cultural organisation’s readiness for interaction with autonomous or semi-autonomous AI agents. It asks whether an agent can reliably identify the institution, distinguish it from similarly named entities, discover available services and actions, interact with machine-readable systems, receive structured responses and record an interaction’s outcome.

The first five AURAS-O dimensions primarily concern how an organisation becomes represented, interpreted and recommended. Observability looks one step further: what happens when AI systems begin acting on behalf of users? An agent might search for an exhibition, check opening hours, compare tickets, identify available performances or prepare a reservation. These are emerging possibilities, not capabilities shared by all current assistants.

This dimension is therefore about readiness for accountable interaction, rather than measuring how often an institution appears in AI answers. Identification, permitted actions and recorded outcomes belong together: finding a service does not confer permission to use it. The practical implications are prospective and depend on the agent, the institution’s systems and the authority delegated by the user.

Research on agent governance asks how delegated actions can become visible, attributable and subject to oversight. Chan et al. examine agent identifiers, real-time monitoring and activity logging, including their privacy and governance implications.^[1]Their subject is visibility into agents, not measurement of an institution’s AI Visibility. AURAS-O extends this concern into a prospective organisational question: how can an institution identify an interacting agent, expose permitted services and retain an accountable record? The paper does not validate this framework dimension.

Emerging protocols such as the Model Context Protocol (MCP) illustrate how AI systems can connect to external services and structured information.^[2] In everyday terms, they provide a shared way for software to describe information and available tools. For cultural organisations, the issue is not adopting one particular protocol, but making authoritative information and permitted actions available in reliable, controlled ways. Stable identifiers, APIs and structured responses are possible building blocks; MCP is neither universal nor mandatory.

Experiments show that crafted product-page text can manipulate model recommendations in a studied setting.^[3]This supports caution about AI-mediated environments, not a claim that all agent interfaces share the same vulnerability. Monitoring interactions and governing permissions remain distinct from counting recommendations. Collectively, current research suggests that as AI systems move from answering questions towards taking actions, organisations may increasingly need to be identifiable and interactable to software agents as well as people and search engines.

An AI travel agent should ideally be able to identify a museum, retrieve current opening hours and exhibition information, distinguish permanent collections from temporary exhibitions and locate an official ticket or reservation interface. A stable identifier could help distinguish the institution from its branches or a similarly named venue. Reading visitor information and making a reservation would remain separate permissions.

For a theatre, an agent may need to identify a specific production, performance date, venue, cast, ticket category and current availability. A festival could expose programme dates, locations, performers, ticketing options and schedule changes through structured services. Responses should distinguish a proposed booking from a confirmed one, with a record of the outcome available for review.

At cultural heritage sites and visitor attractions, an agent may need access rules, seasonal opening hours, booking requirements, accessibility information or visitor restrictions. A descriptive page designed for human browsing may not provide enough structure for reliable automated action. The management question becomes: “Can a machine reliably determine who we are, what is available, and what it is allowed to do?” These examples describe possible readiness requirements, not a mandate to automate booking. Cultural organisations can assess which services are suitable, where human confirmation is necessary and how interaction records can support oversight without collecting unnecessary visitor data.