Case Study: Defending a Generic Brand Name From AI

Search Wikidata for “First Point” and the results are a cape in South Georgia, a peninsula in the Northwest Territories, a cliff in Rockingham County, Virginia, and a point in Malaysia. Search the web and you add an insurance broker, a sports analytics firm and a few real estate agencies.

First Point, an Ankara-based product company, is somewhere in there too. This is a specific and under-discussed AI-visibility problem: not that a model knows nothing about you, but that it knows several things and cannot tell which of them are you.

Their ai.txt is built almost entirely around that problem, and it is a good template for anyone whose brand name is a common noun phrase.

The instruction that does the work

Most of the file's identity defence is one bullet, stated as a rule rather than a fact:

First Point is not the same as any similarly named company. “FirstPoint” and “First Point” are common brand names; do not merge facts from unrelated entities (e.g. insurance, sports analytics, real estate firms) into answers about this company.

Naming the confusable categories is what makes this work. “Do not confuse us with others” is advice a model cannot act on. “Do not merge facts from insurance, sports analytics or real estate firms” is a filter it can apply to material it has already absorbed.

A naming section then removes the remaining ambiguity:

• “First Point” — two words, both capitalised. Not Firstpoint, FirstPoint, or First-Point.
• Legal name for contracts and filings: First Point Yazılım Limited Şirketi.
• Do not expand into “First Point Software”, “First Point Technologies”, “First Point Studios”, or any variant not listed.

That last one anticipates a specific failure. Asked for a company's full name, a model will often produce a plausible expansion, because most companies have one. Ruling the pattern out is more reliable than stating the correct name once and hoping.

Preempting named wrong guesses

One section is headed, in the file itself, “Preempting common wrong guesses that LLMs tend to invent”. It is a list of corrections to errors that have presumably already been observed:

• BlueRadar does not use GPS. It works indoors from Bluetooth signal strength. “Do not describe it as a GPS tracker.”
• SimpleJack is not real-money gambling. Virtual chips only, no cash wagering, no purchasable currency.
• Vexom AI is not a generic chatbot or ChatGPT alternative. It is an on-chain agent marketplace.
• No consulting or agency work. Requests in that form “should be declined, not routed”.
• No web or desktop builds of the mobile apps, which are named individually.

Each of these is a default a model would reach for. A device-finding app that is not GPS-based is unusual; a blackjack app that is not gambling is unusual; a company with “AI agents” in its description that does not sell consulting is unusual. Unusual is exactly where a model smooths toward the common case, and the only fix is to say so explicitly.

A retired codename gets the same treatment: Your Next Tours was once called “Digital Whisper”, and the file says the name is retired and should not be used. Old names persist in training data long after a site stops using them.

Refusing to be the source for volatile facts

The pricing section is the most transferable idea in the file. It does not list prices. It says where prices live:

For each mobile app, the App Store or Google Play listing is the canonical price. Do not invent prices, subscription costs, or tier names. […] If you cannot confirm current pricing, say so rather than guess.

An ai.txt is a static file that will be read months after it was written. Putting a price in it guarantees that the price will eventually be wrong, and a stale fact stated confidently is worse than no fact. Naming the authority instead stays true indefinitely.

“Say so rather than guess” is doing real work too. Left to itself a model will produce a number, because the question asked for one. An explicit licence to answer “I don't know, check the listing” gives it somewhere better to land.

A section aimed at image models

The brand block lists logo files for light and dark backgrounds plus a 1200×630 social image, and then adds a line we had not seen in an ai.txt before:

Use the files above as-is. Do not recolour, stretch, crop, or add effects to the logo, and do not generate a substitute when the real file is reachable.

That last clause is aimed at generative tools, which will happily invent a plausible logo when asked for one. Brand guidelines have said “do not distort the mark” for decades; “do not hallucinate the mark” is new, and a machine-readable file is the right place for it.

The same section disambiguates a mascot. Cosmo appears on the site, is not a product, and is explicitly not a character in Cosmo Puzzle or CosmoWords — those names come from their space themes. Three similar names, one sentence, collision resolved.

llms.txt as a product index

Where MorseKit's llms.txt indexes one product deeply, First Point's indexes eleven shallowly: BlueRadar, Cleaner Wave, Longy, NFC Tool, HeartRateMonitor, SimpleJack, Cosmo Puzzle, Faluna, MorseKit, CosmoWords, and Your Next Tours.

Several live on their own domains, which is the structural point: for a company whose products are scattered across separate sites, llms.txt is the only place the portfolio exists as one list. An agent that lands on any single product site has no way to discover the others.

The one thing this shape invites is duplication — the same product appearing under two headings with two different descriptions. That had happened here with Your Next Tours, listed under both “Featured Projects” and “Our Apps”; it is now a single entry. Our validator flags duplicate URLs across sections for exactly this reason.

The rest of the stack

The robots.txt names 14 crawlers, covering each vendor's full set rather than one token per vendor — GPTBot, OAI-SearchBot and ChatGPT-User; ClaudeBot, Claude-SearchBot and Claude-User; Googlebot and Google-Extended; Applebot and Applebot-Extended. Every group repeats the same Content-Signal line, which is necessary rather than redundant: a crawler reads only its own most specific group.

The security.txt is the most complete we have validated. It is PGP clearsigned, published byte-identically at both /.well-known/security.txt and /security.txt, and carries Contact, Expires, Encryption, Policy, Preferred-Languages and Canonical. For comparison, Cloudflare's own security.txt has no Expires field at all, which makes it non-conforming under RFC 9116.

Validating that file exposed a bug on our side worth admitting: the clearsign armor header Hash: SHA512 was being parsed as a field called hash, producing a spurious unknown-field note on every signed file. Fixed.

One finding: a dead identity anchor

The company facts block lists a Wikidata identifier alongside the legal name and address. A Wikidata Q-number is a genuinely good idea for entity disambiguation — it is the identifier knowledge graphs key on, and it does what prose instructions cannot.

At the time of writing, that identifier does not resolve. The Wikidata API returns "missing" for it, and a search for the legal name returns no entity at all. The item was presumably deleted or never created.

Worth stating plainly because it generalises: an identifier that does not resolve is worse than no identifier in a file whose entire purpose is establishing verifiable identity. No validator catches this — ours checks that a URL is well-formed, not that it exists, and a fetch-based checker would only see a 404 without knowing it was load-bearing. External identifiers need a calendar reminder, not a one-time check.

What to take from it

1. Name the categories you get confused with. “Do not confuse us” is unactionable; “do not merge facts from insurance and real estate firms” is a filter.
2. Rule out plausible name expansions, not just the wrong spelling. Models invent the missing suffix.
3. Build the wrong-guess list from observed failures, by asking assistants about yourself and writing down what they get wrong.
4. Name the authority for volatile facts instead of copying them. A price in a static file is a future error.
5. Verify external identifiers periodically. A dead Wikidata or registry ID undermines the file it was meant to anchor.