Merchants must decide which AI agents to trust before the identity standards are finished

Online shops are being pushed to decide how to treat AI agents, but the tools that prove who an agent is are not finished. Keshia Rose, who leads developer relations at Fingerprint, made this point on Software Engineering Daily. The episode, "Fraud Prevention in the Age of AI Agents," was published on 12 November 2026. Her message: merchants still have to decide whom to let in.

What was said

Rose described how site owners used to think. An automated visitor was probably bad, unless it was a well-known search crawler. That has flipped for some traffic. In her words, "now it's like, well, hold on, we want the bots."

She said people are scrambling to keep out fraud while still admitting people who simply want to use an agent. She called it "now it is like the wild wild west". A speaker on the show said frontier AI labs had approached at least one company about buying on its platform.

Host Gregor Vand brought up Web Bot Auth, which he described as a draft at the IETF, the body that writes internet standards. Rose called it an emerging standard, one of many. She said everybody seems to have their own way of handling e-commerce. She thinks Google and Visa are doing some work there, without detailing it. Still, she called Web Bot Auth a pretty solid start.

Rose described two pieces. First, a bot signs the headers of its requests with a cryptographic key, and a registry lets a site check that the bot is who it says it is. Rose said that alone still lets a bot claim to be anybody. Second, Fingerprint adds its own layer, saying it has checked that specific agents, such as ChatGPT and Claude, belong to the companies they name.

Why it matters

Our reading: a shop that opens its checkout to agents is making a trust decision without a settled rulebook. Rose described a field where everybody has their own approach.

The episode points to a practical question. A signature plus registry lookup shows a bot matches a known entry. A separate ownership check, which Fingerprint says it performs, shows the entry belongs to the company named. Merchants and their fraud teams should ask which of these their tools perform.

The other side

Rose works for a company that sells this kind of verification, so her view carries that interest. The conversation did not say which approach will win.

Detection has a gap too. Rose noted that many bots fetch pages with direct web requests and may never load JavaScript. Fingerprint's usual tools sit in a page or app, so they can miss those visitors. She said an automation intelligence API, aimed at that gap, is coming. For now, merchants are choosing before the rules settle.