Agents aren’t humans (but they kinda are)

AI Agents act as intermediaries between users and websites, blurring the traditional relationship between users and sites. This shift challenges existing security and fraud prevention models, which rely on identifying a direct human user. The core argument is that for websites to maintain control and accountability, new mechanisms are needed to recognize, serve, and hold agents and their operators responsible. Agents can execute actions at scale without the limitations of human behavior, forcing a reckoning for website operators who traditionally managed risks by blocking intermediaries or requiring users to disable them.
The text details numerous challenges introduced by agentic traffic, including account sharing, compliance verification, friendly fraud, identity spoofing, and resource exhaustion. These issues arise because agents do not inherently possess the same accountability as human users; they can execute actions—like purchases or data extraction—without being directly linked to a specific person in a way that satisfies site requirements. The proposed solution involves establishing an Intermediation Principle: maintaining the security relationship between sites and users regardless of intermediation, requiring new tools for visibility and accountability.
The text suggests a path forward through developing open, interoperable standards for identity (like Web Bot Auth) and protocols to allow sites and agents to collaborate on defining acceptable behaviors. This approach moves beyond relying on human verification mechanisms like CAPTCHAs, which are insufficient for distinguishing between humans and non-human agents. The ultimate vision is an Internet where access remains equitable while ensuring that accountability structures adapt to the reality of agentic interaction.

* AI Agents act on the web for millions of people.
* Agents can appear indistinguishable from a human user or multiple users.
* Remote Agents are intermediaries between a User and a Site.
* Traditionally, Security and Fraud Prevention requires Identity, Reputation, and Accountability to establish truthfulness, trustworthiness, and accountability.
* Personal AI Agents automate tasks by pursuing goals using cloud computers or browsers.
* Agents can act without human limitations, running continuously and in parallel.
* Local or on-device Agents are outside the scope of the primary topic.
* The Intermediation Principle requires upholding the business relationship between Users, Sites, and participants regardless of intermediation.
* Challenges for Site Owners include account sharing, compliance verification, friendly fraud, identity spoofing, and resource exhaustion.
* Human verification methods like CAPTCHAs are irrelevant because Agents are not humans.
* Proposed protocols include MOLE and Web Bot Auth (WBA) for agent identity.
* Identity spectrum includes Nothing, Session, Account, and Unique identifiers.
* Site Agents need a machine-readable way to publish allowed actions, rather than relying solely on inference.

The narrative establishes a fundamental tension between the existing architecture of the web, which is predicated on human agency and accountability, and the emergent reality of autonomous, scalable AI agents acting as intermediaries. The central pattern being addressed is the erosion of liability when an opaque entity (the Agent) executes actions that cause harm or abuse, shifting the burden entirely onto the site operator without a clear locus of responsibility. The story of Ezra illustrates this perfectly: the intermediary's utility obscures the chain of action, making traditional accountability mechanisms useless against multi-party transactions.
The argument pivots away from superficial fixes, such as demanding human intervention (HITL), recognizing that these solutions only reintroduce friction and fail to solve systemic issues like traffic commingling or agent identity spoofing. Instead, the proposed solution is architectural: creating an ecosystem of open, interoperable protocols—like WBA and MOLE—to define explicit, machine-readable contracts between sites and agents regarding access, reputation, and actions. This signals a systemic shift from reactive, behavioral policing to proactive, protocol-driven governance.
The implication for human agency lies in the necessity of re-defining what constitutes "being behind an action." If the system accepts agentic actions at scale, control must migrate from verifying the presence of a human to establishing verifiable provenance across the entire chain—from the Operator down through the Agent and any intermediate layers. The risk here is that technical solutions like protocol alignment become purely abstract if they fail to account for the lived, social implications of attribution and trust. What assumptions are being made about the inherent nature of user identity versus agent behavior in these new systems?
Bridge Questions:
How can the ecosystem balance the need for scalable access afforded by agents with the requirement for granular accountability that protects individual users?
If protocols like WBA and MOLE become the standard, what mechanisms must be in place to prevent agents from being deliberately misused to compromise large-scale trust frameworks, rather than simply being tools for legitimate interaction?
What happens to user sovereignty when operational reality increasingly separates the entity acting and the person they act for, and where does legal accountability reside in an agentic environment?