Back to Writing

Writing

Entity Maps and the Authorization Gap: What a Crawler Finds Is Not What You Should Publish

By Paul Bruemmer

An abstract knowledge graph of many connected nodes, with a single node glowing to mark it as verified and authorized while the rest remain provisional.

AI systems now describe organizations before most people ever reach their websites. Ask ChatGPT, Gemini, Perplexity, or Claude about a company, and the tool will often answer directly — what the organization does, who works there, where it operates, how it compares to competitors, whether it fits the question at hand. The links come second, if they come at all.

That shift creates an opportunity and an accuracy problem at the same time.

Most organizations already have the raw material an AI system needs: an About page, team bios, product or service pages, locations, results, articles, FAQs. What they usually lack is a statement of how those things relate, in a form a machine can read without guessing. So the machine guesses. It infers which people are current employees, which addresses are real offices, which capabilities are actually offered, and which claim to trust when two pages disagree. Sometimes it guesses well. When it guesses badly, the organization is often the last to know.

This is the problem the EntityMap standard was built to address. It is also where I think the standard, on its own, stops short — and where the more interesting work begins.

I have spent a long time on the question underneath this one. I wrote about search engines turning into answer engines back in 2012, before the current vocabulary for it existed. The move from matching pages to resolving entities is the same move. It is now arriving at the level of the whole organization.

What an entity map is

EntityMap is an open standard for publishing a structured, entity-first description of what a website knows. Credit where it is due: it was initiated by Fred Laurent, with support from Dixon Jones and Waikay/InLinks, and it is now published openly — a versioned specification, a public repository, and a reference generator, under a Creative Commons license at entitymap.org. The project’s own one-line framing is the clearest: it is a sitemap for what a site knows, rather than which pages it has.

The mechanics are simple. An entity map is typically two files, entitymap.html and entitymap.json, that describe an organization as a knowledge graph — its entities, the products or services it offers, the people behind it, and the relationships connecting them. Every claim is tied to a specific source URL on the site. A sitemap tells a crawler that two hundred pages exist. Schema.org markup annotates a single page. An entity map represents the whole organization as one connected graph, with provenance attached to each assertion.

The reason this matters now is live retrieval. When a model like Gemini answers a question about a brand, it does not always rely on training data. It fetches pages at query time and assembles an answer from what it finds. A file written for that moment can influence answers quickly — in days, not the months that backlinks or indexing take.

What has happened since the standard first appeared

A few things have moved recently, and they are worth reporting accurately.

Waikay, the tool run by Dixon Jones, published a case study on its own site. It installed an entity map on April 25, 2026 as the only change to the site, and reported an AI visibility gain of roughly 26 points on one topic within 48 hours, with the entity-map file cited about 2.2 times more often than its own About page on Gemini and about 3 times more on Perplexity’s Sonar model. A follow-up study using Bing Webmaster Tools data reported a large citation increase on the Bing-fed stack, headlined at around 267 percent.

I want to be precise about what those numbers are. They are vendor-published — measured by the tool’s maker, on the tool’s own domain, and not yet independently replicated. To their credit, the authors say much the same thing: they flag confounding factors, note that one result on one site is not a settled standard, and call for replication by others. Read them as case-study observations, not guaranteed outcomes, and verify the current figures at the source before relying on them. The underlying mechanism — a structured file that live-retrieval models can read and cite — is plausible and consistent with how these systems work. The size of the effect is the open question.

Two other developments matter. The format is now a genuine open standard rather than one company’s file — a stable version 1.0 specification, with healthcare, finance, and education profiles already reserved for the next version. And Waikay has begun offering a paid managed service that builds and deploys entity maps for clients. The concept is already being applied well beyond any single industry, including international B2B, which is the natural direction, because nothing about it is specific to one kind of organization.

Extraction is not authorization

Here is where I part company with the “install the file and watch the numbers move” framing.

Generating an entity map is largely an extraction problem, and extraction is close to solved. Point a competent pipeline at a site and it will produce candidate entities and relationships. But extraction answers the wrong question. The question is not can this fact be extracted. It is should this fact be published as an authoritative statement of what the organization is.

Those are different questions, and the distance between them is where the risk lives. A crawler collects evidence. Evidence is not authorization.

Consider what an automated pipeline gets wrong, in any industry:

  • A former employee still appears in an old post, PDF, or cached bio, and gets published as current staff.
  • A page written to reach a market the company serves gets read as a physical location it does not have.
  • One system records a person’s name one way and another records it differently, producing two people where there is one.
  • A capability mentioned once, in passing, gets represented as a service the company actively offers.
  • Two pages carry conflicting names, addresses, or numbers, and the pipeline picks one — quietly converting an unresolved inconsistency into a published fact.

In a low-stakes context these are cosmetic. In regulated or reputation-sensitive ones — professional services, healthcare, finance, law — they are not. A machine-readable file that asserts these things with provenance is more authoritative to an AI system than a scattered page. That means a confident error is worse than no file at all.

The standard already grades trust. Most maps won’t use it.

The fix is not to distrust entity maps. It is to notice a distinction the specification already builds in, and that almost everyone generating these files at speed will leave at its default.

EntityMap does not treat every file as equally trustworthy. Each map declares a verification status with one of three values: self-declared, meaning the publisher asserts the file is accurate; generator-draft, meaning a pipeline produced it with no human review; and third-party-verified, meaning an outside registry has certified it. The standard is explicit that a file generated without human review must be labeled a generator-draft, and it instructs AI systems reading that file to apply less weight to its more interpretive claims. It goes further: any relationship that carries editorial judgment — that one thing improves, degrades, or is suited to another — has to be flagged with an explicit confidence marker. And there is a third-party certification registry, due to open in the third quarter of 2026, for publishers who want a map verified beyond their own say-so.

Read that structure carefully and the argument is already inside it. The standard grades a map by how much human judgment stands behind it, and tells AI consumers to trust the grades differently. A raw extraction is not a neutral starting point that happens to lack a stamp. It is, by the standard’s own definition, the lowest trust tier there is.

So the gap is not in the specification. It is in practice. A generator will happily produce a complete, well-formed file in minutes, and nothing but the publisher’s own discipline stops that file from being deployed as though a person had stood behind every claim in it. Moving a map from a machine assembled this to someone has confirmed this is the actual work — and it is exactly the distinction the standard tells AI systems to care about. Any organization that would not let an intern rewrite its About page unsupervised should not let a crawler write its entity map unsupervised either.

What an entity map can and cannot do

An entity map lets you tell a machine, in a structured and sourced form: who the organization is, which entity is in control, which people are verified, which products or services are real, which locations are actual, which pages support each claim, and how those pieces relate. That is a meaningful upgrade over forcing the machine to reconstruct all of it from disconnected signals.

It does not compel any AI system to accept, cite, or repeat what you publish. It does not replace accurate content, structured data, or — in regulated fields — the advertising and disclosure rules that still apply. And it does not, by itself, guarantee visibility. Anyone promising that is selling the file, not the outcome.

What it does offer is control over the input. In an environment where AI systems increasingly summarize an organization before anyone visits it, deciding what that summary is built from — deliberately, with a human signing off — is no longer a technical nicety. It is how you keep authorship of your own identity.