How to tell verified agents from unknown bots

The decision

Decide whether you will treat agents that prove who operates them differently from automation that only claims a name, and ask your CDN or bot vendor to do it.

Who decides: Security, with the head of ecommerce or digital.

The options

1. Verify by signature and treat verified agents as customersOperators including OpenAI, Google and AWS sign their agents' requests; your CDN can check the signature. Cloudflare: The Internet has a second audience (30 Sep 2026), read 4 Nov 2026.
2. Require registration, as Zocdoc doesYou know who each agent is and can set rules per agent; fewer agents will bother. Zocdoc for Agents (markdown), read 4 Nov 2026.
3. Treat all automation the sameSimple, but a real customer's agent is blocked along with scrapers. Cloudflare: the agentic internet, WebMCP example (6 Aug 2026), read 4 Nov 2026.

What we found

• 30 Sep 2026

  Cloudflare reported on 30 September 2026 that it sees more than 500 billion verified bot requests each week.

  Cloudflare: The Internet has a second audience (30 Sep 2026), read 4 Nov 2026
• 20 Sep 2026

  Amazon said Muse did not identify itself while browsing its store, one of its reasons for blocking it in September 2026.

  Trade press report. Retail Gazette: Amazon blocks Meta's Muse (22 Sep 2026), read 4 Nov 2026
• Read 4 Nov 2026

  Web Bot Auth is an IETF draft in which an agent signs its requests with HTTP Message Signatures so a site can check who operates it.

  IETF draft: Web Bot Auth architecture, read 4 Nov 2026

How to decide

• Ask your bot vendor whether it checks signed requests and a verified-bot list today.
• Decide what a verified agent may do: read, add to basket, check out. Treat each as its own permission.
• If you run a network or a marketplace, consider registration, which gives you a named human contact for each agent.

Where this shows up

• Self-check question 16Can your team tell verified bots and agents (for example through Web Bot Auth signatures or a verified bot directory) apart from unknown automation?
• The healthcare guideAppointment booking through Zocdoc, Gemini and Amazon Health AI, with patient consent rules.
• The financial services guideComparison and quote apps inside ChatGPT that hand off to the firm's own site.
• The publishing guideSeparate controls for training, search and live fetches, and what Cloudflare changed in 2026.