Reported Platform & EcosystemStandards & ProtocolsAccess Controls DataDome Blog ·

DataDome Evaluates Web Bot Auth and Know Your Agent Trust Frameworks

Open source ↗

Summary

DataDome outlined the mechanisms and limitations of two emerging agent trust standards: Web Bot Auth (WBA), an IETF cryptographic protocol using Ed25519 HTTP message signatures and public key directories at /.well-known/http-message-signature-directory, and Know Your Agent (KYA), an identity governance framework. While WBA verifies platform origin and KYA establishes ownership and authorized scope, DataDome argues that neither guarantees benign runtime execution. The firm advocates combining both standards with continuous real-time behavioral and intent-based enforcement to prevent abuse from authenticated agents.

Insight

Cryptographic authentication proves platform origin and governance defines permitted scope, but neither protocol layer can determine dynamic intent or prevent authenticated agents with over-scoped credentials from executing malicious actions.

Implication

Security teams and web operators cannot rely solely on cryptographic allowlisting or signed bot directories from major providers like AWS Bedrock or Cloudflare to permit autonomous traffic without active runtime behavioral inspection.

Why it matters

As autonomous AI agents rapidly expand across the open web, establishing robust crawler control requires moving beyond static user-agent strings toward multi-layered systems that combine cryptographic provenance with dynamic session analysis.

Evidence