Web Bot Auth & Know Your Agent: Why Identity Isn’t Enough

AI agent traffic is growing fast, and not all of it is welcome. Some agents are legitimate. Others scrape, probe, or automate abuse.

80% of AI agents fail to properly declare themselves when visiting websites, and even the ones that do aren’t necessarily safe or beneficial to your specific business model.

Even agents built using well-known AI platforms from OpenAI, Perplexity, and Meta have been used to execute attacks, including SQL injections, cross-site scripting attacks, and fake account creation. A recognizable provider or verified agent identity can establish provenance, but it cannot guarantee benign behavior.

Web Bot Auth and Know Your Agent are two emerging frameworks designed to bring accountability to agent traffic: one at the cryptographic layer, one at the governance layer. Both are meaningful steps forward. 

Verifying an agent’s identity or the source of a signed request does not tell you what it is doing right now, who is directing its actions, or whether its behavior should be trusted. 

Authentication can establish that an agent or credential is legitimate at a point in time. It does not continuously evaluate behavior, detect anomalous activity, or prevent a verified agent from acting maliciously or outside its intended scope. For that, you need a third layer: continuous intent-based bot and agent detection. 

Here’s how the two standards compare, where each falls short, and what complete agent protection actually looks like.

What is Web Bot Auth?

Web Bot Auth (WBA) is an emerging IETF cryptographic protocol that lets AI agents prove which platform made a request. Think of it as a digital passport stamped by the agent provider. 

The mechanism works through Ed25519 cryptographic signatures on HTTP requests, verified against public key directories hosted at /.well-known/http-message-signature-directory on their own domain. 

When an agent makes a request, it signs it with a private key. The receiving site or security layer (a WAF, for example) verifies that signature against the operator’s public key directory. If the signature checks out, the request is confirmed as originating from a specific AI platform, such as OpenAI or AWS Bedrock.

What WBA establishes: 

• Which platform sent the request
• That the request was cryptographically signed

What WBA doesn’t establish: 

• Who owns the agent
• What the agent is allowed to do
• Whether the agent’s behavior is safe

How does Web Bot Auth work in practice?

The flow is straightforward once you understand the components:

1. Key generation: The agent operator generates a signing key pair (public + private)
2. Directory hosting: The public key is hosted in a key directory on the operator’s domain
3. Verification setup: The site owner configures its security or edge service to validate signatures and apply policies based on verification status
4. Request signing: Every request the agent makes is signed with its private key
5. Verification: The receiving service checks the signature against the public key directory, validates the signature, and applies the appropriate access rules

In practice, that can reduce friction for legitimate agents and give site owners a stronger signal than user-agent strings or IP reputation alone. Web Bot Auth’s current adopters include Cloudflare’s Verified Bots program and AWS Bedrock AgentCore Browser. 

The value is real, but the limit is just as important: Web Bot Auth verifies where a signed request came from. It does not assess intent.

What is Know Your Agent (KYA)?

Know Your Agent (KYA) is a broad framework that binds each AI agent to a verified human owner and defines its authorized capabilities, compliance posture, and behavioral boundaries. 

Where WBA verifies that a request was signed by a recognized agent or operator, KYA establishes who is accountable for that agent and what it is authorized to do. 

The framework draws from established identity verification traditions, like Know Your Customer (KYC) and Know Your Employee (KYE). KYA is designed to bring structure to the lifecycle of an agent, not just the request in front of you.

KYA is built around five pillars:

1. Identity: Who or what the agent is
2. Capability: What it can and cannot do
3. Authorization: What it is permitted to do
4. Behavior: How it acts over time
5. Verification: Ongoing trust validation, not just a one-time check

What KYA establishes: 

• Accountable ownership or representation
• Defined scope and authorization 
• Auditability
• Compliance alignment 

What KYA doesn’t establish: 

• Whether the agent is behaving safely right now, since past authorization does not equal safe current behavior

Why does KYA matter? Real-world examples

The case for KYA isn’t theoretical. The recent incidents below show exactly what happens when agent identity governance is absent. 

McKinsey Lilli breach

In March 2026, security researchers at CodeWall used an autonomous AI agent to probe Lilli, McKinsey’s internal AI platform, discovering 22 unauthenticated API endpoints. One contained an SQL injection vulnerability that exposed 46.5 million chat messages, 728,000 files, and 57,000 user accounts.

PocketOS database deletion

In April 2026, a Cursor AI agent deleted an entire production database in under 10 seconds. The agent found an API token with broader authority than its assigned scope and acted on it. The agent wasn’t malfunctioning—it was acting on its own judgment with an over-scoped credential. 

Orphaned automation

When a developer leaves an organization, their AI agents may continue to run using their own credentials, despite the lack of human oversight. Offboarding fails to catch these “ghost agents,” since an agent’s credentials are separate from an employee’s.

Web Bot Auth & Know Your Agent: What’s the difference?

WBA and KYA are complementary, not competing. They answer different questions and operate at different layers of the stack.

WBA and KYA both strengthen identity, but neither provides continuous intent-based detection and protection. 

Why neither is sufficient on its own

A cryptographically authenticated agent with established KYA credentials can still behave maliciously or outside its intended scope when it reaches your site.

WBA alone verifies where a signed request came from, not its intent. An authenticated agent from a major AI provider can still scrape your prices aggressively, probe for weaknesses, or trigger rate limits.

KYA alone can establish accountability, authorization, and scope, but those trust signals do not guarantee that every action the agent takes is safe. An agent authorized for read-only access can still exploit a misconfigured endpoint or behave outside its intended purpose.

The common gap is that identity, source, and authorization signals alone cannot determine whether an agent’s current behavior is safe. Continuous analysis of behavior and intent is still needed as the agent interacts with your systems. 

And the threat environment keeps changing. With the rise of AI-powered data breaches and a 180% year-over-year increase in multi-step fraud attacks, identity and authorization alone are not enough to keep endpoints secure.

What you need: Identity plus behavioral intelligence

Identity helps establish where an agent request came from and accountability. Behavioral intelligence tells you whether to trust what it’s doing right now.

A complete protection model combines three layers:

Layer 1: Identity verification (WBA + KYA) 

WBA and KYA provide complementary identity and accountability signals:

• The verified identity associated with the signed request
• The person or organization accountable for the agent

This creates a strong signal of accountability, but not safety by itself. Compromised keys or stolen credentials can pass identity checks, making continuous behavioral and intent-based detection critical.

Layer 2: Authorization (KYA) 

KYA can establish what the agent is authorized to do:

• Scope
• Permissions
• Policy constraints
• Intended purpose

Authorization helps prevent overreach, but an agent can still behave maliciously or unexpectedly within its authorized scope.

Layer 3: Behavioral enforcement 

Behavioral enforcement continuously evaluates and acts on what the agent actually does. This is where real-time protection comes in.

Behavioral enforcement adds what identity and authorization signals alone can’t provide:

• Real time intent detection: Analyzing every request in milliseconds to determine whether agent behavior aligns with legitimate use or indicates malicious intent
• Trust scoring: Continuously updating each AI agent’s trust score based on identity strength, behavioral intent, and reputation
• Session-level pattern analysis: Evaluating behavior across an entire session to identify patterns and multi-step activity that may not be apparent from a single request
• Automatic mitigation: Rate limiting, challenges, or blocking without disrupting legitimate users or requiring manual intervention

If the behavior looks risky, the system can rate-limit, challenge, or block in real time. This is the missing layer between identity and safety.

How should site owners approach agent identity and protection?

The right approach is not to choose between WBA and KYA. It is to use both where appropriate and combine their signals with behavioral enforcement.

A practical strategy looks like this:

1. Register and recognize legitimate agents. Use WBA and other verified-bot mechanisms to authenticate recognized agent traffic and reduce unnecessary friction.
2. Apply KYA where appropriate. For AI systems you deploy or permit, establish clear accountability, scope, and authorization.
3. Add behavioral enforcement and monitor continuously. Use a real-time bot and agent trust layer, like DataDome, that evaluates behavior and intent alongside available identity and authorization signals.
4. Protect traffic whether it is verified or not. Your protection should not depend on every agent providing identity credentials.

DataDome brings these signals together, supporting both Web Bot Auth and Know Your Agent alongside real-time behavioral intelligence and enforcement. DataDome can verify WBA signatures and incorporate identity and authorization context provided by KYA partners to make more informed trust decisions in real time. 

Named a Leader in The Forrester Wave™: Bot and Agent Trust Management Software, Q2 2026, DataDome analyzes intent to stop fraud in under 2 milliseconds with 99.99% detection accuracy.

Book a demo to see how DataDome’s Agent Trust features give you complete visibility and control over every agent, verified or not.