← Joseph Denne

September 2026

The web spent twenty years asking people to prove they're human. The next twenty will be about telling good machines from bad ones, and treating the good ones as guests.

Click the traffic lights. Click the crosswalks. Click the fire hydrants. For two decades the web's answer to abuse has been to make every visitor sit a small, humiliating exam, and to call it security. It never was. It was a tax on people, paid in attention, to make up for the fact that we couldn't tell who was knocking.

That approach is now failing in a new way. A growing share of legitimate traffic isn't a person in a browser. It's a shopping assistant comparing prices. A booking agent checking availability. A research tool reading documentation on behalf of a developer who asked it a question. On some of the sites we run, agents are already the majority of visits. Treat all of them as attackers and you've just blocked your own customers. Let all of them through and you've opened the door to the ones who really are scraping, spamming and stuffing credentials.

The binary is the bug

The error at the root of CAPTCHAs is the verdict. Human or bot. Pass or fail. Reality isn't binary, and the moment you pretend it is you've thrown away the information you needed.

What a site owner actually wants is a score. How confident are we that this visitor is a person? If it's a machine, has it told us who it is? If it has, is that claim verifiable? A score lets you make the decision that fits your context. Let a 90 through without friction. Ask a 40 for a single click. Send a verified shopping agent straight to your product API, where it will be more useful to you than it ever would be on your HTML. Block an anonymous automation that's hammering your login form. Four different outcomes from one signal, and none of them involves a person identifying a bus.

Identity is the fast path

The agentic web has, quietly, started to solve its own identity problem. Web Bot Auth, an IETF standard backed by the largest model providers, lets an agent cryptographically sign its requests. A site can verify the signature and know, not guess, that this is a particular agent acting for a particular service. Confirmed crawlers can be checked against reverse DNS. The machinery for telling good machines from bad ones already exists.

That changes the policy. Automation that declares itself gets the fast path: verified, routed, welcomed. Automation that refuses to identify itself is, by definition, the traffic you can afford to be hard on. The incentive points the right way for the first time. Declaring who you are makes life easier, not harder, for the machine doing it.

Privacy isn't a setting

The other failure of the old approach is what it collected. To distinguish humans from bots, the incumbents built fingerprint databases, tracked visitors across sites and stored behavioural profiles, then asked for consent after the fact. Security became surveillance, and most site owners never noticed because the widget was free.

It doesn't have to work that way. Verification can be scored in memory and discarded. The only thing that needs to persist is an hourly counter. No cookies, no per-visitor storage, no fingerprint database, nothing to consent to because nothing is collected. We built Shield this way not because it was easy but because the alternative, a security product that is itself a privacy risk, is a contradiction I didn't want my name on.

What this means for the people building sites

Three things, in order.

First, measure before you assume. "We don't have a bot problem" is almost always an assumption rather than a measurement, and automated traffic doesn't announce itself. Put an invisible score on every visitor and look at the mix for a fortnight. Most sites are surprised.

Second, write an agent policy before you need one. Which agents do you welcome? Where do you route them? What do you block? These are product decisions, not security decisions, and every site will face them soon whether or not anyone is attacking it.

Third, stop testing your users. If your verification is visible to a real person, it's costing you conversion and goodwill to solve a problem that can now be solved silently. The humans who visit your site aren't robots. The robots that visit your site can increasingly tell you who they are. Build for that world. It's already here.

← More writing · Also as markdown.