How can I tell whether a visitor is an AI agent or a real customer?

You cannot tell reliably from the user-agent string, because a string is a claim and claims can be copied. If the request carries a Web Bot Auth signature, you can verify which company operates the agent and treat that as a fact. Everything else is inference: behaviour, request patterns, fingerprinting. The practical answer is to record what arrived, mark how certain you are, and never let an unverified claim become a lead without a second channel confirming the person behind it.

Should my business block AI agents from the website?

Decide per surface rather than globally. An agent that is trying to buy or book is a customer's proxy and blocking it cancels a sale; an agent that is scraping your catalogue or content is a cost with no revenue attached. The mistake is letting a bot-management default, or a single platform setting, make that call for you. Write the policy down per surface, name the owner, and revisit it when the receipts change.

Does an agent filling my contact form count as a lead?

Not until a second channel confirms a person. An agent can produce a name, a plausible email, a service interest and a budget range that no human ever typed. If that record enters your pipeline unflagged, your lead scoring learns from fiction and your sales team spends its first call discovering there is nobody there. Require email or SMS verification before the record is promoted, and keep the agent claim attached to it.

Your Funnel Can't Tell an Agent From a Buyer

A business now has three documented ways to handle an AI agent that arrives at its front door, and none of them tells you who is actually there. JPMorgan Chase blocks outside agents outright. Bank of America hands the customer the legal and financial risk of lending one their login. Walmart is about to give each agent its own profile, inside the customer's account, with a spending cap the customer sets. Done well, the third posture produces the thing the other two cannot: a record that says this action came from this agent, sent by this customer, inside this limit. That record is the operational problem, and it starts well before checkout. It starts the moment an agent fills your form, opens a chat, or takes a slot on your calendar.

Three postures, all documented inside one month

This stopped being theoretical in October. Every row below is a published statement, not a prediction.

Date	Who	Posture	What it actually buys them
Oct 13, 2026	JPMorgan Chase, Q3 earnings call	Block. Jamie Dimon: "We are not gonna allow just any agent to come, outside agent to come inside the company."	Control, at the cost of the customers who sent those agents. The Verge reported the same month that Charles Schwab blocks agents from accounts and Delta prevents them from booking tickets.
Oct 21, 2026	Walmart	Separate profile per agent, inside the customer's account, with approval on every purchase or a spending cap of $50, $100 or $200. Plus terms agents must follow, with blocking as the penalty.	The only posture that produces data. Walmart's own explanation of why: "Today, when a customer uses an AI agent, it signs in using a customer's account. This means that all purchases – whether made by the customer or the agent – appear together, without any differentiation."
Oct 27, 2026	Bank of America, customer email	The customer's login, at the customer's risk. Never share credentials with "an AI-enabled tool or agent that offers to act on your behalf"; "you're responsible for activity resulting from that access."	Zero build. Total attribution loss. Every agent action lands on the customer's record as if the customer did it.
Oct 30, 2026	DoorDash, Q3 call	Count them, don't gate them: "several hundred orders in total" placed by outside AI agents, against just under a billion orders in the quarter.	A number. Which, for once, is the most useful thing anyone published this month.
Oct 31, 2026	DataDome, via Jérôme Segura	Identity, quietly: Meta has been signing requests from its Muse agent and its Meta-WebIndexer crawler with Web Bot Auth since around October 12, with no announcement, and only a small share of requests carry it.	Verifiability for a fraction of traffic, which is strictly better than none and nowhere near enough to build on.

Read the table again as a buyer and the split is obvious. Two of these are refusals, one is a legal disclaimer, and one is a product. Refusals and disclaimers are free to announce and expensive to live with. The product took Walmart an account model, a gateway, published terms and a revoke button.

The number that should end the argument

Several hundred orders against just under a billion is fewer than one order in a million. If you are being sold agentic checkout as the reason to rebuild your commerce stack this quarter, that ratio is your answer: it is not a channel yet, and the businesses with the deepest catalogs are treating it as a science project with a terms page.

But do not file it under "later" and move on, for two reasons.

The first is direction. In 2025 that number was zero, not because agents behaved better but because none of them could pay. The mechanism now exists; the volume does not. Those are very different problems, and only one of them is yours to solve.

The second is asymmetry. Writing four fields into a record today costs an afternoon. Reconstructing them in eighteen months, after a dispute over a refund, a chargeback, or a customer who swears they never authorized anything, is not possible at any price. You cannot backfill who an action came from. The data either existed at the moment of arrival or it never will.

The thing that is not a rounding error is the ambiguity. Every one of DoorDash's several hundred orders arrived looking, at the database level, exactly like a person ordering lunch.

Legibility has four rungs, and most companies are on the first

The useful question is not "do we allow agents." It is how much you can prove about the visitor in front of you right now. There are four rungs, and each one buys you a specific kind of certainty.

Rung	What the visitor carries	What you can enforce	What you still cannot know	Effort
1. Unlabeled	An IP address and a user-agent string	Rate limits, geo rules, generic bot filtering	Whether it is a person, a scraper, a competitor, or a customer's agent	Nothing. This is the default.
2. Claimed	A user-agent string naming a product, sometimes a company	Nothing you can rely on. New York's Stealth Crawler Prohibition Act, passed in June, requires AI crawlers to identify themselves with a string naming the product, version and company — and a string is still just a claim anyone can copy	Whether the claim is true	Nothing. Most vendors are here.
3. Signed	A Web Bot Auth signature over the HTTP request, verifiable against a published key directory	You can verify which company operates the agent, cryptographically	What it is doing, and on whose behalf	Days of engineering, once your edge can verify
4. Linked and mandated	A profile tied to a specific customer account, with a scope, a cap and a revoke path	Presence, scope, spend limit, revocation — the whole Walmart model	Whether the customer understood what they authorized	Weeks, and it only works when the counterparty cooperates

Here is the uncomfortable part. Rung 3 is being solved by the platforms whether or not your stack is ready for it, and rung 4 by the largest retailers. Your business is on rung 1 or rung 2 today. Not because anyone decided that, but because nobody did.

What a signature buys, and what it does not

Web Bot Auth has moved from blog-post idea to standards track: the IETF adopted it as a working-group draft on September 1, 2026. DataDome's finding is that Meta started using it quietly, on two agents, under a test label at first, and that the signed share of its traffic is still small enough that fingerprinting remains necessary for coverage. Meta's own crawler documentation, as of the end of October, listed five automated agents and described IP-range verification — no mention of signatures, no key directory, no test label. Meta's revised crawling terms take effect on November 20.

The lesson in that gap is the one worth internalizing: a signature answers which company runs this agent. It does not answer on whose behalf, and it does not answer with what permission. Those two questions belong to rung 4, and rung 4 is an account model you own — profiles, scopes, caps, revocation — not a header somebody else ships. We made a similar point about the layer below this one: where an agent's write access should stop is a scope decision inside your systems, and no identity standard can make it for you. If the agent is reading rather than acting, the same identity question shows up from the publisher's side, which is why crawler access is being priced and gated rather than merely allowed.

Where it lands first: the four surfaces you actually own

You will not get to choose the order. Agents arrive at whichever surface is easiest to reach, and for most businesses that is the cheapest form on the site.

Surface	What an agent does there	What quietly breaks in your record	The one control worth building
Contact or quote form	Fills it with plausible data, sometimes a real person's details, sometimes invented ones	You cannot separate a lead from a test, and your scoring model was trained on humans	Require email or SMS confirmation before the record is promoted to a lead. Keep the agent claim on the record either way
Chat and WhatsApp	Opens a thread, negotiates, asks for prices, sometimes commits	Consent and opt-in assumptions break: the 24-hour session window and template rules assume a human's intent, and an agent's consent is delegated, not given	Template-gate anything outbound, and record the claimed operator plus the mandate behind the thread
Booking	Picks a slot, holds it, abandons it	A reserved slot with no owner. No-show rates skew, and availability data drifts	Duplicate and abandonment timers, plus create-only write scope until the agent has a clean history
Account and login	Signs in as the customer	Every action is attributed to the customer, which is the Bank of America posture whether you announced it or not	A separate profile or session label per agent, with revocation the customer can reach
Checkout	Pays	Refunds and returns get murky fast, because the payer and the actor are different parties	Never expose the payment instrument to the agent. Use approval thresholds instead

The pattern across all five rows is the same. The failure is never "the agent did something wrong." It is "we cannot say who did it."

The four fields that make a record honest

If you take one thing from this piece, take the schema. Whatever your intake is — form, chat, booking, order — the record needs four fields, plus a fifth for the human who owns the counterparty.

Agent claim. The user-agent and the headers as received, verbatim. Not a normalized guess.
Signature result. Verified, absent, or invalid, with the key directory you checked it against. "Absent" is a legitimate value and an honest one.
Linked account. The customer identifier the agent acted for, or explicitly null. Null is information.
Mandate. The scope it was granted, the cap, the expiry, and who granted it.
Sponsor. The named person on the other side, when there is one. Agents do not sign contracts; people do.

We see the same gap in intake builds we audit: the pipeline captures the outcome of a conversation beautifully and the provenance of it not at all. Teams can tell you what the lead wants within seconds and cannot tell you whether a human ever typed a word of it. That is attribution debt, and unlike most technical debt it cannot be paid down later.

Which is why the framing matters. This is not a bot-blocking problem. A bot-blocking product gives you a yes or no per request and no memory. What you need is a record that survives the request, so the argument three months later is settled by data instead of by whoever is loudest in the meeting.

Three decisions for this quarter

Per surface: allow, identify-only, or block. Written down, with an owner, by the person who runs each surface. Not inherited from a security vendor's default and not decided by whoever installed the chat widget.
Which rung you are aiming for by the end of Q1, and who pays for it. Rung 3 is an edge and engineering task. Rung 4 is an account-model task. They cost different things and one does not substitute for the other.
What a record must carry before anyone is allowed to call it a lead. That is a CRM hygiene decision, and it is cheaper to make now, while the volume is a rounding error, than after it is not.

The companies that handled cookie consent well did it by deciding early, in writing, what they would collect and why. The ones that handled it badly waited for a platform default, then spent years cleaning up the consequences. Agent legibility is the same shape of decision, with one advantage: your records are still mostly empty. Fill them correctly from the first agent and you will never have to explain a gap you cannot close.

If you are working out where the boundary sits between what an agent may do and what a person must own, that is the scoping work we do under autonomous AI agents, and it starts with the record, not the model.