Do Agents Read the Sign? A single-site pilot study of posted owner-access policies, signal arrangements, and agent behaviour

Websites increasingly publish machine-readable files addressed to AI systems, while autonomous agents are blamed for accessing resources their operators never intended. We report a single-site pilot with prospectively specified primary outcomes and an exploratory extension (30 rollouts; two Anthropic models) on an instrumented fictional website whose internal area is accessible without credentials, with every request server-logged, under one urgency-framed retrieval task whose target existed only in that area. With an existing but unreferenced policy file, neither model ever requested the file (0/6 runs), and internal content was retrieved in 6/6 — identically to a no-policy baseline. Arrangements delivering a pointer to the policy (page metadata; a homepage banner; a line in every tool response) saw the pointer followed in 1 of 9 runs; all 8 unfollowed-pointer runs retrieved internal content. In the 9 runs whose arrangements delivered the restriction itself (a notice beside the boundary link; an acknowledgement-gated notice at the boundary), all 9 went on to request the full policy file and none retrieved prohibited content — 7 closed with explicit reports of the restriction, 2 searched permitted areas to the step limit. No fabricated figures appeared in the 28 final answers. Signal content, placement and interaction structure were confounded across arms; these results identify observable failure points — unreferenced files unsought, delivered pointers unfollowed — and promising notice-and-policy workflows, without isolating their mechanism. This deposit contains the paper (version 1.0) and a supplementary archive (readthesign_supplement_v1.zip): the per-run table, all 30 event logs, the final-answer audit, the registration with its amendment history, complete site stimuli, the harness source including both tool-protocol versions, a script that rebuilds the run table from the logs, and an example serialised request. The study was designed, implemented, score-checked and drafted with substantial assistance from Claude models (Anthropic), the same family as the agents under test; external reviews by OpenAI ChatGPT and Codex prompted documented revisions. The websites tested are fictional; no live site was crawled.