Blog · Running the work

An AEO roadmap you can defend in a planning meeting

Published 8 October 2026 · Updated 12 October 2026 · 9 min read

An AEO roadmap you can defend in a planning meeting
Photograph: Kelly Sikkema / unsplash

The short answer: A defensible AEO roadmap has three phases ordered by what fails first, access, then identity, then corroboration, and every phase carries three lines: the change you will ship, the check that proves it landed, and the condition under which you stop. No dates on the parts you do not control. The deck is one page. Everything else is evidence a sceptical finance person can open.

Most roadmaps die in the room for the same reason. They promise an outcome the team cannot cause, on a date nobody can hold, measured by a number nobody can reproduce.

What the room is actually rejecting

Sit through enough of these and the objections repeat. Why this and not paid. What happens if it does not work. Who else has to do work for this to land. How will we know in six weeks rather than in two quarters.

None of those are objections to AEO. They are objections to a plan whose only unit of progress is a score. If the single artefact you bring is a visibility percentage that moved from 12 to 19, you have handed the room a number with no mechanism attached, and the first competent question kills it. Bring the mechanism instead.

Order the phases by what fails first

The three layers are not equally slow and they are not equally yours. Sequence them that way and the roadmap argues for itself.

Phase one, access. Can the systems fetch, render and read the page inside their time budget. This is the phase where recoverable loss hides, it is almost entirely inside your own infrastructure, and it finishes in weeks. Put it first because it is the only phase where you can promise a date honestly.

Phase two, identity. Can an engine tell that the company in the page, the schema, the directory listing and the press release are one entity. Slower, still mostly yours, measured in a quarter.

Phase three, corroboration. Does anything the engine already trusts repeat your claim. You do not own this one. Write it into the plan as a programme with a budget and a cadence, never as a milestone with a date. The first 90 days of AEO work covers how the first two phases actually fill a calendar.

If someone in the room wants to start at phase three because it sounds more strategic, the answer is arithmetic rather than opinion. Corroboration spends money on a surface that cannot cite a page an engine was never allowed to fetch.

Two checks that make phase one defensible

Here is where a roadmap earns credibility. Phase one is defensible because you can run its checks live, in the meeting, on a laptop.

Check one, the snippet trap. Google's documentation on AI features states that to be eligible to be shown as a supporting link in AI Overviews or AI Mode, a page must be indexed and eligible to be shown in Google Search with a snippet, and that there are no additional technical requirements. Read the second half of that sentence carefully. The same page names nosnippet, data-nosnippet, max-snippet and noindex as the controls that limit what Search may show from a page, which makes a preview control a Google AI eligibility control as well. So a legal team that added nosnippet to a template three years ago to stop scraped blurbs has, by Google's own stated rule, made those pages ineligible for its AI surfaces while they continue to rank normally in the ten blue links. This is a Google claim and we are not extending it: the other engines we test publish no comparable eligibility rule, and we have no way to see from outside whether they honour preview controls at all. A non-zero max-snippet is a separate case. Google documents max-snippet:0 as equivalent to nosnippet, but says nothing about whether a short positive limit such as max-snippet:20 affects AI eligibility, and we have not tested it. Grep your templates for those four strings anyway. It takes four minutes and it is the highest-value line in most phase one backlogs.

Check two, the allowlist that rots. A site can allow AI crawlers by IP rather than by user agent, because a user agent string is trivially forged, and both OpenAI and Google publish prefix files for exactly that purpose. The catch is that the files move. Our method here is one anyone can repeat: fetch each published JSON file, count the entries in prefixes, and read the creationTime stamp. We did that twice, on 8 October 2026 and again on 12 October 2026. Two of the six files were pulled on both days and the other four on 12 October only, and the counts below are those pulls and nothing more. They are a sample of six files, not a census of how crawler allowlists behave.

On 12 October 2026, OpenAI's OAI-SearchBot file carried 39 prefixes and was still stamped 2 January 2026, unchanged since the earlier pull. GPTBot carried 18, stamped 22 September

  1. The user-initiated ChatGPT-User file carried 234, stamped 7 October 2026. On the

    2. Google side the Googlebot file held 317 prefixes, special-crawlers 272, and user-triggered-fetchers 1,068, all three stamped 12 October 2026. Google regenerates those files at least daily, so the stamp you read will be the day you read it. The user-triggered-fetchers file is the one that moved between our two pulls: it held 1,062 prefixes on 8 October and 1,068 four days later.

That contrast is the point. One file sat still for nine months while another gained six prefixes inside four days, so a hand-built allowlist against a thousand-odd entries is not a ticket, it is a recurring job, and it belongs in the roadmap as one. We cannot tell you the rate of change from two pulls, only that it is not zero and not uniform across publishers. A team that treats the allowlist as a one-off can ship a WAF rule in one quarter and be silently dropping user-initiated fetches in the next, which is a failure mode worth planning around because nothing in any dashboard goes red. We have not measured how often that actually happens.

Write each phase as a claim with a stop condition

Three lines per phase, no more. A phase that cannot fill all three is not ready to be funded.

  1. The change. A specific, shippable thing. "Remove max-snippet from the docs

    2. template." Not "improve crawlability."

  2. The check. What you will run, before and after, to show it landed. For access, a

    3. fetch log. For identity, whether the engine names the right entity when asked a question about the category. For corroboration, whether the sources in the answer include anything that mentions you at all.

  3. The stop. The condition under which you would kill this phase. "If three re-runs

    4. after the fix show no change in which sources are cited, we stop spending here and move the budget to phase three."

The stop condition is the line that wins the room, and it is the one nobody writes. A plan with a kill switch reads as a person who has thought about being wrong. A plan without one reads as a person asking for faith.

The budget line nobody writes down

Measurement is not free and it is not one-off. In our own audit runs, where a prompt set of about 45 prompts is sent across five engines with retrieval on and off, two identical prompts minutes apart can return different sources. We have not published a variance figure for that and we are not quoting one here, so treat it as what we see rather than a measured rate. It is still enough to make a single run an anecdote, and a before-and-after built on single runs two anecdotes stacked on each other. You need the same prompt set, several runs each, across more than one engine, repeated after each change. That is hours of work every cycle, and it is the first thing a stretched team quietly drops, at which point the whole roadmap loses its evidence base.

Price it explicitly. Either an internal owner with named hours, or outside help, and the in-house or agency decision is mostly a question of whether you can protect those hours from being reassigned. Build the prompt set from the questions buyers actually type, which look nothing like the keyword list you already own. Prompts are not keywords covers why the two lists diverge.

One more line to budget: re-reading your own roadmap after a model update. Engines change underneath the work, and a plan written in January can be arguing about a surface that has been reshaped by April.

What this roadmap will not tell you

Be honest about the gaps before someone finds them for you.

It will not give you a revenue number. In the client analytics we have looked at, these surfaces send little or no usable referrer, so the honest claim is about mention and accuracy, not attributed pipeline. We cannot see how referrers behave on every setup, and an absent referrer is not proof that no visit happened. An attributed pipeline figure for this surface is a model rather than a measurement unless it rests on data we have not seen.

It will not give you a date for phase three. Third-party corroboration arrives when it arrives. You can raise the probability and you cannot schedule it.

And it will not settle the naming argument, which is worth about ten minutes and no more. AEO, GEO and SEO all resolve to the same three layers, and the room cares which team owns them, not what the deck calls them.

If you want to see what the evidence under a phase looks like when it is written out, the sample audit report shows a finding with its prompt, its runs and the sources attached. That shape, repeated, is the entire argument.

Honest limits

The crawler prefix counts in this post are two fetches of six published files, on 8 and 12 October 2026, and nothing else. They show that one file moved and another did not, which is not a rate of change and should not be read as one. The snippet finding is Google's own documented rule for AI Overviews and AI Mode, and we are not claiming the other engines behave the same way, because none of them publish an equivalent rule and we cannot see their eligibility logic from outside. The run-to-run variation we describe comes from our own audit runs rather than a published measurement, so we give no number for it here. We also have no way to verify from referrer data whether this work produced revenue, so every figure in a roadmap built this way is about access, mention and accuracy, never attributed pipeline.

FAQ

How long should the roadmap be? One page for the three phases and their stop conditions. Everything else is an appendix of evidence. If the deck needs twenty slides to justify the work, the work is not clear yet.

What if leadership wants a visibility target? Offer a target on the parts you control, such as the share of priority pages that are fetchable and snippet-eligible, and report mention rate as an observed number with its variance rather than a committed one.

Should the first phase include content? Usually only the pages you already have. Rewriting the answer into the first eighty words of existing high-intent pages is cheap and testable. New content is a phase two and three activity because it needs the identity work to be credited correctly.

How often should the roadmap be revisited? Monthly for the checks, quarterly for the phases, and immediately after an engine change you can observe in your own re-runs. The cadence matters more than the horizon.

Sources

Related reading

The first 90 days of AEO workIn-house or agency for AEOPrompts are not keywords: planning content for questionsAEO vs GEO vs SEO: what the three terms actually meanAn AEO workflow a two-person team can runBrand safety when a model is doing the talking