Published 13 November 2026 · last updated 13 November 2026
Three days ago the Linux Foundation launched the Agent Name Service (ANS) for verifiable AI agent identity. Most bot management tools roundups still rank vendors on blocking scrapers. This one asks: can the tool tell a scraper from your customer's own agent?
TL;DR: The best tools now verify which agent product is knocking, but Arkose Labs found only 2.3% of legitimate agent sessions carried a verified signature in Q3 2026, so behaviour still decides most calls.
- DataDome — best for verified-agent policy at the edge
- HUMAN Security — best for per-agent action rules
- Arkose Labs — best for agents that don't identify themselves
- Kasada — best for developers (via Vercel BotID)
- Fingerprint — best for building agent policy in your own code
- c/side — best for agentic browsers at the browser layer
- Netacea — best for server-side, no-script deployment
- Castle — best for login and signup abuse on a budget
Methodology & sources
- Capabilities from vendor product pages, docs and press releases, read 10–13 November 2026; prices from public pricing pages.
- Ranked on five criteria: verifies signed agent identity; per-agent policy; handles unsigned agents; logs what allowed agents did; published price.
- Cloudflare, Akamai and Imperva: benchmark rows, unranked.
- Disclosure: this is Aissist's blog. Aissist sells AI agents that resolve customer conversations, not bot management, and is not ranked here.
What is AI agent traffic management?
AI agent traffic management is classifying automated visitors by who sent them and on whose behalf, then applying a policy to each.
"Bot" now means three populations that need opposite treatment. Arkose Labs splits good agents into self-disclosing and non-disclosing; we split by the posture each one needs.
| Population | What it looks like | Right posture |
|---|---|---|
| Scraper | Crawler or headless script extracting content or prices | Block, rate-limit or charge |
| Verified delegated agent | Signed agent product acting for a signed-in customer within granted scopes | Serve, then execute and log the scoped action |
| Unverified claimant | Says it is ChatGPT or Muse, carries no valid signature | Challenge; never grant account actions on the claim |
The third row burns sites. When DataDome tested roughly 700,000 sites with a spoofed ChatGPT-style user-agent, 79.7% let it through unchallenged. A user-agent string is a name tag anyone can print.
The middle row is the commercial one: treat it as a scraper and you lose the sale; treat every claimant as that agent and you lose the account.
How do the 8 tools compare on agent identity?
All eight separate agent products from generic bots to some degree; six document support for Web Bot Auth signatures; none verifies which customer delegated the agent.
| Tool | Classifies scraper vs delegated agent? | Supports a signed agent identity standard | Allow-list by agent profile | Logs the allowed agent's actions | Published price (Nov 2026) | Free tier |
|---|---|---|---|---|---|---|
| DataDome | By agent product, trust-scored | Web Bot Auth | Yes, custom rules | Requests and endpoints | From $3,830/mo | No |
| HUMAN Security | By agent product | HTTP Message Signatures; ANS-style naming | Yes, per-agent action rules | Requests and actions on site | Quote only | No |
| Arkose Labs | Three populations incl. non-disclosing | Web Bot Auth | Yes, per journey step | Sessions | Quote only | No |
| Kasada | By agent product | Web Bot Auth | Yes, policy per verified agent | Requests and endpoints | $1 per 1,000 checks via Vercel Pro | Vercel Basic |
| Fingerprint | Returns signed / verified / unknown / spoofed | Web Bot Auth | You write the rule | Per-event API | $99/mo (Pro Plus) | 1,000 calls/mo |
| c/side | Browser-layer agent classification | Web Bot Auth (vendor blog) | Yes, per agent type | Sessions and on-page actions | $99/mo | 1,000 calls/mo |
| Netacea | Server-side intent | Not documented | "Trusted automation" policy | Not documented | Quote only | No |
| Castle | General bot score | Not in product docs | No dedicated agent signal | Login and account events | $200/mo (Pro) | $5 usage/mo |
| Cloudflare (benchmark) | Signed agents category | Web Bot Auth (proposer); ANS contributor | Yes | Requests | Not compared | — |
| Akamai (benchmark) | Validated-bot directory | Web Bot Auth | Yes | Requests | Not compared | — |
| Imperva (benchmark) | Behavioural bot protection | Not confirmed | — | Requests | Not compared | — |
Read the fifth column twice. Every vendor logs requests. None records that customer X's agent was authorised to change order Y, and did. That record must come from whatever performs the action.
Reading all eight vendors' docs this week, only Fingerprint published the exact verification states it returns, signed through spoofed, in its AI agent documentation. Specific beats impressive.
The 8 bot management tools, ranked
DataDome leads on verification plus per-agent rules plus a published price; Castle ranks last only for lacking a dedicated AI agent signal.
1. DataDome — best for verified-agent policy at the edge
DataDome is a bot and fraud platform that scores every AI agent on a 100-point Agent Trust scale and enforces rules at the edge. Agent Trust is listed in the $3,830/month Essentials plan.
- Pros: Web Bot Auth verification live for all customers; 60+ attributes for custom rules.
- Cons: No free tier; Essentials is a big first cheque for an SMB.
- Our take: The default for mid-market sites with real agent traffic. Not for teams spending under $4,000 a month on security.
2. HUMAN Security — best for per-agent action rules
HUMAN Security's AgenticTrust module lets customers let one agent browse but not check out while setting different guardrails for another. Its open-source Verified AI Agent names agents with OWASP's ANS.
- Pros: Action-level rules; earliest ANS alignment of the eight.
- Cons: Quote-only pricing; enterprise-weighted.
- Our take: Best when policy must differ by action, not just agent; overkill for a content site.
3. Arkose Labs — best for agents that don't identify themselves
Arkose Labs' Agent Trust Manager classifies traffic as customer, authorised agent or adversary, then applies Allow, Monitor, Challenge, Throttle or Block.
"Businesses can no longer count on agents to announce who they are." — Kevin Gosschalk, CEO, Arkose Labs (via Help Net Security)
- Pros: Built for the 97.7% of unsigned sessions; strong at login, signup and checkout.
- Cons: Quote only; challenge-led, so friction is a lever you must tune.
- Our take: Pick it if unsigned personal agents already hit your password-reset flow; skip it for read-only content.
4. Kasada — best for developers
Kasada's AI Agent Trust adds a verified agent directory with Web Bot Auth support and per-agent policies enforced at the edge. Kasada also powers Vercel BotID Deep Analysis, $1 per 1,000 checks on Vercel Pro.
"They want precise control over what different agents can and cannot do." — Jono Hope, Head of Product, Kasada
- Pros: Usage-priced entry via Vercel; no CAPTCHAs.
- Cons: Direct contracts are quote only; the Vercel route needs Vercel hosting.
- Our take: Easiest serious start for a Next.js team; small teams off Vercel should look elsewhere.
5. Fingerprint — best for building agent policy in code
Fingerprint returns each agent's provider, name and Web Bot Auth verification status via its Server API, with AI Agent Detection in Pro Plus at $99/month.
- Pros: Cheapest documented signed-agent verification; transparent states.
- Cons: A signal, not an enforcement layer; recognises only agents in its directory.
- Our take: Ideal when engineering owns the policy; wrong if you want a console that blocks for you.
6. c/side — best for agentic browsers
c/side detects agents running in real browsers, such as OpenAI Operator and Claude for Chrome, from a first-party script. AI agent detection is on its $99/month Business plan.
- Pros: Sees in-browser behaviour that network tools miss; self-serve.
- Cons: Script-based, so it covers pages, not raw API calls.
- Our take: Strong against agentic-browser checkout fraud; no substitute for API protection.
7. Netacea — best for server-side deployment
Netacea's Trust Layer classifies automated traffic server-side, before requests reach the application, with no client script.
- Pros: No browser script; covers web, app and API.
- Cons: No public signed-identity support; quote only.
- Our take: Good where scripts are banned; not yet for verified-agent allow-lists.
8. Castle — best for account abuse on a budget
Castle scores logins and signups for bot, takeover and abuse risk, with a free tier and a $200/month Pro plan.
- Pros: Real self-serve pricing; account-level focus.
- Cons: No dedicated AI agent signal in its product docs.
- Our take: Fine for signup fraud; not yet built to welcome a customer's agent.
Which agent identity standard should you bet on?
Web Bot Auth is the only one these tools ship; ANS, PAP and PACT are early, and standardising on any one of them today is a bet.
"open standards are essential to making the agentic web both trustworthy and interoperable" — Dane Knecht, CTO, Cloudflare, Linux Foundation ANS announcement
Standards status, 13 November 2026:
- Web Bot Auth — IETF working-group draft, revised 1 September 2026. Proves which operator signed a request.
- ANS — Linux Foundation project since 10 November 2026 (intent announced 23 June); DNS-anchored, versioned identity across seven spec documents; no version number published.
- PAP (Personal Agent Protocol) — Meta and Sierra, announced 6 October 2026; drafts 0.1–0.3 published, 0.4 in progress. OAuth sign-in at the company, scoped actions.
- PACT — Decagon and Instinct, 6 October 2026; signed delegation tokens on A2A and OAuth 2.0.
- A2A — 150+ supporting organisations as of 9 April 2026; Agentic AI Foundation project since 17 August 2026.
Note the layering. Web Bot Auth and ANS answer which agent; PAP and PACT answer which customer, and what they allowed. Bot tools sit on the first layer. "PAP" and "PACT" also each name unrelated IETF drafts, so check the author before citing the spec.
What happens after the bot tool lets an agent in?
Allowing a verified agent through is the easy half; the hard half is executing its scoped request and logging who asked.
A bot tool's job ends at the door. Behind it, something must check the customer's delegation, act within scope, and record agent, customer, scope and outcome together. Our breakdown of delegated authorization for AI agents covers the token side, AI gateways the enforcement point, and the Personal Agent Protocol explainer covers the consent flow.
Security owns the door; support owns what happens next. Allow a customer's agent that no system can serve and you've built a faster route to a ticket queue. For retail specifics, see AI agents for ecommerce; to audit your own exposure, run the AI agent security review.
Verdict: verify the agent at the edge, verify the customer behind it
Buy a bot tool that verifies signed agents and writes per-agent rules; don't expect it to prove delegation. DataDome and HUMAN lead for most mid-market sites, Arkose for unsigned agents at sensitive flows, Fingerprint or Kasada-via-Vercel for engineering-led teams. Then make sure what sits behind the door can act on a scoped request and log it.
Frequently asked questions
How do I detect AI agent traffic on my website?
Verify Web Bot Auth signatures where present, then use behavioural detection for the rest. Most legitimate agents don't sign yet, so signature-only rules miss nearly all of them.
Should I block AI bots and scrapers completely?
Block scrapers, not every agent. A customer's delegated agent checking an order is revenue; a blanket block turns it away along with the scrapers.
What is the Agent Name Service (ANS)?
ANS is an open standard, now a Linux Foundation project, that anchors AI agent identity to DNS and certificates using versioned names like ans://v1.0.0.payments.example.com, per Unite.AI's summary.
Is Web Bot Auth the same as agent permission?
No. Web Bot Auth proves which operator signed the request. Whether that agent may act for a given customer is a delegation question for protocols like PAP or PACT, or your own OAuth scopes.
Which bot management tools have a free tier?
Fingerprint and c/side offer 1,000 free API calls a month, and Castle a $5 monthly usage allowance. Vercel BotID Basic is free, with Kasada-powered Deep Analysis paid.
Changelog
- 13 November 2026 — First published.
