Standard
IETF draft standard built on HTTP Message Signatures (RFC 9421) that lets AI agents and bots cryptographically sign requests so sites can verify the operator.
Cloudflare has introduced a system that scores Verified bots on robots.txt compliance and on whether they slow down after an HTTP 429. It reports the result as a trust band, and Cloudflare says it will share scores on Radar later.
Reality
Amazon cut Meta's Muse off for arriving unannounced, browsing without identifying itself, and appearing to keep customer credentials. Signed-request verification, already running at Cloudflare and CloudFront, answers the middle objection.
Perspective Coverage
7 publishersReality
Ahrefs, Known Agents, Profound and Scrunch run a Worker on every request, so a 20-file page spends 21 of Cloudflare's 100,000 free daily invocations. A site with 10,000 page views a day would need more than twice that.
Reality
Cloudflare says AI-agent requests on its network grew more than 1,700% in a year as non-human traffic passed half the total. It now wants sites to identify and price agents as customers, after advising last year that new domains block AI training crawlers.
Reality
The 51.7 percent in DataDome's 2026 bot report is login's share of five sensitive endpoint types, and Jerome Segura told Lets Data Science the same 313 million requests work out to about 1.08 percent of the 29.02 billion requests the company could classify by path.
Reality
The spec's own boundary list says a verified catalog entry establishes which domain claims a capability and what trust material it published. It says nothing about whether the calling process is the agent it names.
Reality
HTTP 402 sat in the spec unused since 1991. The x402 flow makes it callable. The work lands inside your crawler: two origin requests per priced page, a funded wallet on the server's chain, and settlement checked before any retry.
Reality
The bot submission form moves into Application Security and grows a history tab, which means the entry describing your crawler becomes a record you are expected to keep matching your traffic rather than a form you filed once.
Reality