Agent Wranglers

AGT-4Recommended

Choose a default for unsigned agents

Write down what happens to a request that claims to be an agent but carries no valid signature. Treat it like an anonymous visitor, with the visitor's limits.

By Agent Wranglers. Updated .

How to do it

Most agents do not sign yet, so blocking every unsigned request also blocks people's assistants. Give unsigned traffic exactly what an anonymous browser gets, and nothing that a verified agent gets. A user agent string that names a known agent changes nothing. Answer a request over the visitor limit with 429, as Limit how often anyone can call your APIs says. Review the default every 6 months, as more operators sign their requests.

Examples

JavaScript example

export function agentPolicyFor(req, verifiedOperator) {
  return verifiedOperator ? AGENT_POLICY[verifiedOperator] ?? ANONYMOUS_POLICY : ANONYMOUS_POLICY;
}

Python example

def agent_policy_for(verified_operator: str | None) -> dict:
    if verified_operator is None:
        return ANONYMOUS_POLICY
    return AGENT_POLICY.get(verified_operator, ANONYMOUS_POLICY)

How to check

Send a request with the user agent of a listed operator and no signature. It gets the same status, limit and content as a plain anonymous browser request.

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/identifying-agents/unsigned-agent-default">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.