If you receive agent traffic

Classify every request into exactly one of three: verified agent (header present and covered by a valid Web Bot Auth signature), declared agent (header present, unsigned), unknown actor (no header).

The one rule that matters: unknown is not human. If you treat missing headers as human, you teach agents to hide.

The header tells you what the sender claims. It never proves a person approved anything or that a customer delegated anything. Check those the way you do today.

Use the claim to pick a workflow: let a declared autonomous agent read balances, make it step up to pay, deny it ownership changes. See the example policy table

Experimental: if a request names an operator, this demo checks in the background whether that domain publishes agents through DNS-AID and whether the header matches the default they publish (the private-use disclosure= and webbotauth-keys= keys, which are experimental and in no draft). The result is reported, never used to change the classification.