This page answers one question: in what order should you learn the skills behind Web4? Learn Web4 uses a practical working definition of Web4 focused on AI agents, agent-readable information, and agent-mediated actions. Other definitions of Web4 may emphasize spatial computing, virtual worlds, digital twins, decentralized systems, or physical-digital integration.
Learning this space in the wrong order is the most common failure mode: people jump to agent frameworks before they understand HTTP, or to structured data before they know what crawlers see. The ten stages below are ordered by dependency — each assumes the previous ones. Definitions are kept to a line or two; the linked articles and official docs carry the depth. For the concepts before the sequence, start with Web4 for Beginners.
The ten stages at a glance
| # | Stage | Core question it answers | Maps to |
|---|---|---|---|
| 1 | Web basics | How does a page actually reach a client? | Foundation |
| 2 | SEO and crawlability | Can machines find and fetch my pages? | Level 1 — Discoverable |
| 3 | Structured data | Can machines interpret what the page says? | Level 2 — Understandable |
| 4 | LLM basics | What can language models do and not do? | Agent literacy |
| 5 | Tool calling | How does a model act on the world? | Level 3 groundwork |
| 6 | Agent architecture | How do planners, memory, and loops fit together? | Agent literacy |
| 7 | API design | Can agents call my service predictably? | Level 3 — Actionable |
| 8 | Identity and permissions | Who is the agent acting for, and what may it do? | Level 3 — Actionable |
| 9 | Evaluation | How do I test agent behavior before it matters? | Level 3 — Actionable |
| 10 | Security and governance | What keeps agents safe, auditable, and accountable? | Level 3 — Actionable |
The right-hand column references a Learn Web4 framework: the Three Levels of an Agent-Ready Website — Discoverable, Understandable, Actionable. The canonical framing: “Agent-ready is not the same as AI SEO. A site that agents can find is not necessarily a site agents can understand, and a site agents can understand is not necessarily a site they can safely act on.” Stages 1–3 teach you to build for the first two levels; stages 7–10 teach what the third demands. The full model lives in The Three Levels of an Agent-Ready Website, and Agent-Ready Is Not AI SEO explains why the distinction matters.
Stage 1: Web basics — HTTP, HTML, how pages are served
What to learn. What happens between a URL and a rendered page: DNS, the HTTP request/response cycle, status codes, headers, and what server-rendered HTML looks like versus content injected later by JavaScript.
Why this position. Everything later — crawlability, structured data, tool calls, API design — is HTTP and HTML underneath. Without this stage, every later concept is a magic box.
You are ready to move on when you can open browser dev tools on any page, read the network requests, and explain which response contained the main content and what its status code and content type were.
Where to learn it. The MDN HTTP documentation is the standard reference; any hands-on static-site tutorial covers the serving side.
Stage 2: SEO and crawlability
What to learn. How crawlers discover pages: robots.txt, sitemap.xml, internal links, canonical URLs, status codes, and whether your key content is present in the HTML a crawler receives.
Why this position. Discovery comes before understanding. An agent or search engine that cannot fetch your page cannot do anything else with it — this is Level 1, Discoverable.
You are ready to move on when you can audit a small site and answer: is every important page linked from somewhere, listed in the sitemap, allowed by robots.txt, and returning a 200 with its main text in the raw HTML?
Where to learn it. Google’s SEO Starter Guide (official requirement and recommendation source for Google Search) and the build-focused pillar How to Build an Agent-Ready Website.
Stage 3: Structured data — Schema.org and JSON-LD
What to learn. How to describe a page’s entities in machine-readable form: JSON-LD syntax, common types (Article, FAQPage, Organization, BreadcrumbList), and the rule that markup must match visible content.
Why this position. This is Level 2, Understandable, applied to your own pages — and it is far easier once you can see what crawlers see (stages 1–2). It also builds the schema literacy you will need when agents consume APIs in stage 7.
You are ready to move on when you can write JSON-LD for an article page from scratch and validate it, without copying a snippet you do not understand.
Where to learn it. Schema.org’s getting started guide plus the structured-data sections of What Is an Agent-Ready Website?. If you encounter llms.txt here, treat it as a proposed convention — support varies by tool; see What Is llms.txt?.
Stage 4: LLM basics
What to learn. What a large language model actually does: next-token prediction, context windows, why models hallucinate, and why the same prompt can produce different outputs.
Why this position. You now know how the classic web serves machines; this stage explains the new kind of machine. Learned here rather than first, its limits map onto concrete web behavior — for example, why an LLM-based agent may trust a confident but wrong page.
You are ready to move on when you can explain to a non-technical colleague why a model gave a wrong but fluent answer, and what a context window implies for how much of your site an agent can “see” at once.
Where to learn it. AI Agents vs Chatbots for the behavioral distinction and What Is the Agentic Web? for how LLM-driven agents participate in the web.
Stage 5: Tool calling / function calling
What to learn. The mechanism by which a model requests an action: the model emits a structured call with a function name and arguments, your code executes it, and the result goes back into the context.
Why this position. This is the hinge between reading and acting — the doorway from Level 2 to Level 3. It requires stage 4: you must understand the model only proposes calls; your code decides whether to run them.
You are ready to move on when you have built a minimal loop — one tool, schema validation on the arguments, result returned to the model — and can explain what happens when the model invents an argument that fails validation.
Where to learn it. OpenAI’s function calling guide and Anthropic’s tool use documentation (both official, current vendor recommendations).
Stage 6: Agent architecture — planners, memory, loops
What to learn. How single tool calls become agents: the plan-act-observe loop, short-term versus long-term memory, sub-agents, and where loops should stop.
Why this position. Only after wiring one tool call by hand (stage 5) do framework abstractions mean something. Learned too early, frameworks hide the failure modes you most need to recognize: runaway loops, stale memory, compounding errors.
You are ready to move on when you can diagram a simple agent — planner, tools, memory, stopping condition — and name two ways it can fail at each component.
Where to learn it. Microsoft’s AI Agents for Beginners course, and AI Agents vs Agentic AI for the vocabulary boundary.
Stage 7: API design
What to learn. What makes an API callable by software that cannot improvise: predictable resource structure, consistent error shapes, versioning, pagination, and documentation a machine can parse (e.g., an OpenAPI spec).
Why this position. This is where you flip from using agents to serving them — Level 3, Actionable, from the provider side. It comes after stage 6 because you have now been the confused consumer of a bad API and know what an agent cannot recover from.
You are ready to move on when you can review an endpoint and list the ways an agent call could go wrong: ambiguous errors, undocumented required fields, side effects with no confirmation step.
Where to learn it. The OpenAPI Specification for machine-readable API description; the Level 3 sections of the agent-ready pillar for the action-safety checklist.
Stage 8: Identity and permissions — OAuth, scopes, API keys
What to learn. How a system knows who an agent acts for: API keys for service identity, OAuth 2.0 for delegated user authority, scopes as least-privilege boundaries, and token expiry.
Why this position. Permissions only make sense once there are actions worth restricting (stages 5–7). Skipping ahead here is how agents end up holding far more authority than their task needs.
You are ready to move on when you can design the scopes for a hypothetical agent — say, one that reads your calendar and drafts replies — and justify each scope you deny it.
Where to learn it. RFC 6749, the OAuth 2.0 framework specification (official standard), is dense but canonical; most provider docs give gentler walkthroughs.
Stage 9: Evaluation — testing agent behavior
What to learn. How to measure whether an agent works: task-level success rates, adversarial and edge-case test sets, regression checks when models or prompts change, and why demo-driven confidence fails.
Why this position. You cannot evaluate what you have not built, so this follows stages 5–8. It comes before security because testing is also your first security instrument — most governance controls are enforced through evaluation harnesses.
You are ready to move on when you have a repeatable test set for one agent task — fixed inputs, expected outcomes, a pass threshold — and you have seen it catch at least one real regression.
Where to learn it. The OpenAI Evals repository shows one established approach to structured model evaluation; apply the same discipline at the task level, not just the model level.
Stage 10: Security and governance
What to learn. The risk layer: prompt injection, tool abuse, data exfiltration through agents, audit logs, action confirmation, idempotency, undo and refund paths, and human handoff for irreversible steps.
Why this position. Last, because it wraps everything. Each earlier stage contributes an attack surface — crawlers, schemas, tools, APIs, tokens — and governance is the discipline of controlling them together. An agent that can act but cannot be audited, constrained, or reversed is not actionable in any safe sense.
You are ready to move on when you can run a threat-model pass over an agent system and, for every tool it can call, state the worst plausible misuse and the control that limits it.
Where to learn it. The OWASP Top 10 for LLM Applications (current community-standard risk list) is the reference to work through item by item.
The fork: site owner vs agent developer
The ten stages are one sequence, but two roles should weight them differently:
| Stage | Site owner / content lead | Developer building agents |
|---|---|---|
| 1 Web basics | Deep — you cannot audit what you cannot see | Deep |
| 2 SEO and crawlability | Core work | Working knowledge |
| 3 Structured data | Core work | Working knowledge |
| 4 LLM basics | Enough to make good decisions | Deep |
| 5 Tool calling | Conceptual — know what your developers are wiring | Core work |
| 6 Agent architecture | Conceptual | Core work |
| 7 API design | Review-level: can you spot an agent-hostile endpoint? | Core work |
| 8 Identity and permissions | Know which questions to ask | Deep |
| 9 Evaluation | Ask for the test results before launch | Core work |
| 10 Security and governance | Own the policy; delegate the mechanics | Deep |
The fork is about emphasis, not exemption. A site owner who knows nothing about tool calling will approve designs they cannot evaluate; a developer who skips crawlability will build agents for a web they misread. Hypothesis, in the Learn Web4 view: the most useful practitioners are T-shaped across this table — one column deep, the other literate.
When this sequence does not apply
- You are maintaining an existing site, not starting from zero. Run stages 2–3 as an audit first with the Agent-Ready Website Checklist, then loop back to stage 1 only for the gaps the audit exposes.
- You work inside a platform that abstracts the web layer (a hosted CMS, a managed agent framework). You still need the mental models, but the readiness checks shift from “can you build it” to “can you verify what the platform does for you.”
- Your interest is Web3-leaning Web4. This roadmap covers the agent-centric definition stated at the top. If decentralized infrastructure is your focus, AI Agents and Blockchain and Web3 vs Web4 map that adjacent territory.
Keeping the plan current
Stages 1–3 rest on standards that move slowly; stages 5–10 cite vendor docs and community lists that are revised often — prefer the official documentation linked at each stage over any summary, including this one. When a stage’s readiness check starts feeling easy, that is the signal to move forward, not to wait for the roadmap to be perfect.
Further reading
- Search Engine Optimization Starter Guide - Google Search Central
- Function calling guide - OpenAI
- AI Agents for Beginners - Microsoft
- OWASP Top 10 for Large Language Model Applications - OWASP
FAQ
Do I have to learn the ten stages in this exact order?
The order follows real dependencies — tool calling makes little sense before LLM basics, and permissions make little sense before API design. You can overlap adjacent stages, but skipping ahead usually means circling back.
Which stages matter most if I run a website and do not code?
Stages 1 through 3 are your core work, stage 4 gives you enough agent literacy to make good decisions, and stages 8 through 10 are worth skimming so you know what to ask of developers.
How long does the full roadmap take?
Editorial interpretation: expect months, not weeks. Stages 1 through 4 can be covered in a few weeks of part-time study; stages 7 through 10 each involve real project work before the readiness checks pass.
Where does llms.txt fit in this roadmap?
It belongs to stage 2 and 3 territory as a proposed convention for helping agents find key pages. It is optional, support varies by tool, and it never substitutes for crawlable HTML and clear content.
Changelog
- : Rewritten as a ten-stage learning sequence with per-stage readiness checks and separate tracks for site owners and agent developers.
- : Initial publication.