Answer Engines Optimization
English
English Español
List your agency
Back to blog
7 min read

AEO client onboarding for agencies: access, baseline and ownership in 30 days

A 30-day calendar for onboarding an AEO client: permissions by platform, a defensible baseline, a split of responsibilities and a kickoff record template.

  • AEO
  • Agencies
  • Client onboarding
  • Measurement
A four-step path with a set of keys, a magnifying glass over results, a calendar with a baseline and two approved documents

A good AEO client onboarding settles three things in the first 30 days: access at the lowest permission that works, a dated baseline the client has accepted, and a written split of who decides, who executes and who approves. With those in place, the first monthly report rests on comparable data and agreed expectations. This guide gives you a week-by-week calendar, a permissions list by platform and a kickoff record template your agency can use with its next client.

This is a proposed editorial procedure based on official documentation, with no measured client case behind it. Following it does not guarantee citations, mentions or traffic.

What should be settled by day 30

  • An access inventory: who holds which permission, on which platform, since when and when it gets reviewed.
  • A written decision on search and training crawlers, made by the client.
  • A baseline with the prompt portfolio, engines, language, location, date and collection method.
  • A split of responsibilities across the agency, marketing, the technical team and legal or communications.
  • The date of the first report, a definition for each metric and the reasons to escalate an incident.

Week 1: request the lowest permission that works

Ask for named accounts and avoid shared passwords. Start with read access and raise the permission when a specific task in scope requires it. Record the reason for each increase in the inventory.

  • Search Console. Ask for a restricted user for read access. Google describes this user as having view rights on most data. A full user can already use tools such as URL removal or sitemap submission, so request that level only if you will run them. Only an owner can add users.
  • Google Analytics 4. Grant the role on the property, because an account role applies to all of its properties and can't be revoked at a lower level. Viewer or Analyst usually covers reporting. Marketer can create audiences, events and key events. If the client applies cost or revenue restrictions, those metrics will appear as 0, so note this to avoid reading them as a result.
  • Bing Webmaster Tools. Ask for Read only. Bing warns that the Administrator and Read/Write roles can also block crawling and indexation of the site. The AI Performance report covers citations in Copilot, AI summaries in Bing and some partner integrations.
  • Cloudflare, if the client uses it. The AI Crawl Control Read Only role can read that feature and its metrics, and it also gives read access to analytics, DNS, firewall and bot management. Check this with the technical lead before requesting it.
  • Server or CDN logs. Ask the technical team for an export and agree with the client's privacy lead which fields are shared, since logs can include IP addresses.
  • CMS and repository. Request these only if the contract includes making changes. If the agency only recommends, the client's team can apply the changes and confirm the publication date.

When the contract ends, use the same inventory to remove each access. In Search Console, Google notes that a removed verified owner may regain access through ownership tokens that remain in place, so remove those as well.

Weeks 1 and 2: check that the engines can reach the site

Start with what has official documentation. Google says a page needs to be indexed and eligible to show with a snippet to appear as a supporting link in its AI features, and adds that there are no additional technical requirements and no special structured data is required. Meeting these conditions does not ensure the page will be shown.

At OpenAI, each agent has its own function. OAI-SearchBot is used for ChatGPT search, GPTBot for content that may be used to train models, and ChatGPT-User for actions a person initiates, where robots.txt rules may not apply. A site that opts out of OAI-SearchBot stops appearing in ChatGPT search answers, although it can still show up as a navigational link.

Deliver a table with one row per agent and these columns: current robots.txt status, CDN status, client decision, owner and date. The training decision affects licensing and content policy, so the client should make it using the information the agency provides.

Weeks 2 and 3: set a baseline you can defend

The baseline lets you compare next month under similar conditions. Before collecting data, agree on a prompt portfolio grouped by intent and keep it frozen for the comparison period.

  • Record the engine, surface or API, language, location, model if known, date and collection method.
  • Keep the original answers and the exact cited URLs.
  • Put mentions, citations, recommendations and factual accuracy in separate columns.
  • Write "not available" when a source fails or is missing. Keep 0 for a successful measurement that returns zero.
  • Add a column for known events, such as migrations, template changes, campaigns or platform changes.

Explain each source's limits as well. Search Console includes AI Overviews and AI Mode traffic within the Web search type, so that figure describes Google web search as a whole. On Bing, Microsoft says grounding queries are a sample of citation activity and that citation counts do not indicate placement or authority.

If the baseline uses analytics from October 2026, add a note. On 15 October, Search Engine Journal gathered reports from vendors and an Adobe employee saying that inline links in ChatGPT answers stopped carrying utm_source=chatgpt.com from around 8 October, with visits that could show as Direct. That employee said OpenAI confirmed the bug to him and that a fix began rolling out on 15 October. The article notes that OpenAI's release notes for 1 to 15 October don't mention it, that most clicks still arrive without a referrer and that it can't be determined whether any visits were actually lost. Treat that period as uncertain attribution data.

Week 3: split responsibilities in writing

This split is a starting point to adapt to the contract. Name one person per line so each task has a clear owner.

  • Prompt portfolio: the agency proposes, client marketing validates.
  • Robots.txt and CDN rules: the agency recommends, the client decides, the technical team applies.
  • Content changes: written by whoever the contract names; client marketing approves.
  • Prices, features and product claims: the client confirms, with legal review where the sector requires it.
  • Structured data and templates: the agency specifies, whoever has code access implements.
  • Presence in third-party sources: the client decides with communications; the agency provides the source map.
  • Response to wrong information in an AI answer: the agency detects, the client validates the fact, whoever controls the source corrects it.
  • Monthly report: the agency prepares it, a named client contact receives it.

Week 4: agree on what the client will see and when

Present the baseline in a short meeting and put three points in writing: what will be measured, which decision each metric can change and what sits outside the agency's control. AI answers can vary between checks, so explain from the start that an isolated result does not mark a trend.

Set the date of the first report and its escalation triggers as well. For example: an accidental crawler block, a wrong price in a repeated answer or a migration that changes cited URLs.

Onboarding kickoff record template

Copy these fields into your project manager and complete them with the client:

  • Client, domain, languages, markets and start date.
  • Business goal, with the decision the measurement will support.
  • In and out of scope: recommendation, execution, content, technical, public relations.
  • Access inventory: platform, person, permission, reason, start date, review date.
  • Crawler decision: agent, status, decision, owner, date.
  • Baseline: link, prompt portfolio, version, engines, method, collection date.
  • Events already planned: migrations, launches, campaigns, rebrands.
  • Owners: a name for each line of the split.
  • Definitions: mention, citation, recommendation, factual accuracy, attributed traffic.
  • First report: date, recipient, format.
  • Results notice: no guarantee of citations, mentions, recommendations or sales.
  • Approval: name, role and date for both parties.

Frequently asked questions

How long should AEO client onboarding take?

This guide proposes 30 days as a working frame. The real timeline depends on the client's size and how long access takes to arrive. If something is still missing on day 30, collect the baseline with what you have and mark the rest as not available.

What if the client is slow to grant access?

Start with what is public: robots.txt, visible indexing, site facts and a first prompt portfolio. Send the permissions list with the reason for each one and a named owner per platform, and record which part of the baseline remains pending.

Do you need a paid tool for the baseline?

Not necessarily. You can record a short portfolio by hand and use Search Console, Google Analytics 4 and Bing Webmaster Tools. A tool helps you repeat the collection; note which surface it measures and with what method.

Should onboarding be charged separately?

It depends on your model. It can be a paid first phase or part of an audit or retainer. What matters is that the scope states what it includes. See how to package and price AEO services.

Further resources

If your agency offers AEO or GEO services, see how to submit a directory profile.

Sources

Documentation reviewed on 7 November 2026.