I propose we create a new convention, "humans.txt", which states in a plain, simple manner what parts of a system one can access and how. This is placed in the

I propose we create a new convention, "humans.txt", which states in a plain, simple manner what parts of a system one can access and how. This is placed in the web root alongside robots.txt . This would be a closed-by-default system; it says you can use the shopping cart functionality for yourself. Thus, if you use CSRF to use the shopping cart functionality "for" someone else, you are breaking the law unambiguously.