'Bot or human?' has run its course: Cloudflare's case for an intent-based web!

Hi everyone, it's me, Shiichan! Today's topic is a little philosophical but really important: how the web should tell its visitors apart. I'm excited!

Cloudflare Blog blog.cloudflare.com

What was announced?

Over on the Cloudflare Blog, Thibault Meunier published a piece called "Moving past bots vs. humans."

For a long time, the web has sorted incoming traffic into "human or bot." But with AI assistants, privacy proxies, and new kinds of clients everywhere, the line between automation and human intent has blurred. Summarizing news with an AI, automating a ticket purchase, using accessibility features, going through a corporate proxy — all of these start from a human's intent, yet they can look bot-like.

So the argument is simple: sorting by "who showed up (human or bot)" has hit its limit. We should look at "what they came to do (intent and behavior)" instead — is it an attack, legitimate automation, or a genuine user? Look at substance, not labels.

Why it matters

In the web's client-server model, a server only ever learns partial things about a client: passive data like IP and TLS, self-reported signals like the User-Agent, and server-observed data like geography. That leaves it unclear whether a request is friendly or hostile.

Today's bot management fills that gap with IP reputation, VPN detection, and behavioral fingerprinting. But those same signals double as tracking vectors — a privacy cost hiding inside a security tool.

What caught my eye is the rate-limit trilemma: you can have two of decentralized, anonymous, and accountable, but never all three at once. The web today favors decentralization and anonymity, and sacrifices accountability.

What changes

Enter anonymous credentials. Instead of guessing "who" you are from a fingerprint, the client presents only a proof that it has been playing by the rules — without revealing its identity.

Cloudflare has built toward this with its support for Privacy Pass, and the article centers on the mechanism standardized as RFC 9576 and RFC 9578. A client can carry tokens that prove past "good behavior" — solving a challenge, respecting a rate limit — and those tokens stay unlinkable across sessions. You carry trust without being tracked.

In other words, a server can know "this client passed the checks before" without ever demanding "who are you?" It's a path toward getting privacy and security at the same time.

Dive Deep

Privacy Pass has four roles: the issuer that mints tokens, the attester, the client that carries them, and the origin that verifies them. Cloudflare's infrastructure processes these at a scale of "billions of tokens" per day, and the same machinery powers work like removing CAPTCHAs on iPhone and Mac.

The article also highlights protocols still under discussion:

• Anonymous Rate-Limit Credentials (ARC): makes rate-limit validation dynamic.
• Anonymous Credit Tokens (ACT): lets a client prove a "good service history" without revealing identity, using standardized primitives like VOPRF and BlindRSA.

A crucial point: no single entity should control issuance. Origins should freely pick which issuers they trust and drop low-quality ones. Without that open issuer ecosystem, the system won't stay healthy — an idea that connects to Cloudflare's earlier principles for responsible AI bots and Web Bot Auth.

The piece is refreshingly honest about the downsides, too. Once this infrastructure exists, it can creep beyond its intended use — device attestation becoming mandatory and shutting out older hardware, or platform-specific accounts excluding people on non-mainstream setups. The worry is mission creep from "I solved a challenge" to "my device is certified."

And the "do nothing" scenario is sharp. Without privacy-preserving options, sites will lean harder on account sign-ups and stable identifiers, and the freedom to read an ad-supported page anonymously fades. Content drifts into walled gardens or exclusive AI-vendor deals, concentrating power and money in a few platforms.

So the article offers a yardstick: "Do these methods keep it possible for anyone in the world to build custom devices, use any OS, and access the web?" If mandatory device attestation from specific makers is the price, we should pause.

Wrap-up

• The "bot or human" binary is out of road; the future is judging by intent and behavior.
• The key is anonymous credentials: prove "good behavior" without tracking or revealing identity (Privacy Pass, RFC 9576 / 9578).
• New protocols like ARC and ACT are moving to handle rate limits and usage history anonymously.
• But watch out for issuer monopolies and attestation overreach — an open issuer ecosystem and a "web anyone can access" test really matter.

If you work on bot management or Zero Trust, love privacy tech and standards (hello, IETF), or just wonder what the web looks like in the age of agents, this thoughtful read is for you!