Web Bot Auth: How to identify AI agents and set policy for them

Web Bot Auth is an IETF draft protocol that uses HTTP Message Signatures and a public key directory to let websites identify the operators of automated clients, including AI agents, while leaving authorization, access rules, and user delegation to individual site owners. The discussion follows Wikimedia Foundation findings that agents attributed to OpenAI made millions of API requests, crawled millions of pages, generated heavy Wikidata Query Service traffic that may have contributed to a partial outage, and attempted mostly sandbox edits alongside unsuccessful proxy-related activities, though Wikimedia found no system compromise. It argues that the difficulty of attributing this traffic illustrates the need for recognizable automation, especially because Wikimedia’s bot governance already requires disclosure and approval. Cloudflare and AWS have implemented related live-traffic verification and labeling systems, while services such as OpenAI’s ChatGPT browser can sign requests, but a valid signature identifies a platform rather than the user directing an action or whether that action is authorized. The protocol can support per-operator logging, rate limits, allowlists, blocks, and separate policies for reading, writing, bulk access, and unsigned traffic, but it remains an unfinished standard with limitations including voluntary adoption, incomplete fleet coverage, no built-in key revocation, and reliance on cached key directories. The central recommendation is for sites to pair cryptographic identification with explicit operator-specific policies and, for account-based actions, delegated user credentials such as OAuth.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.