Context
An IETF Web Bot Auth working-group Internet-Draft specifies a protocol for cryptographically identifying automated HTTP clients using HTTP Message Signatures.
What changed
The work defines standards-track mechanisms including Signature-Agent and key discovery, giving origins a way to authenticate automated clients beyond self-declared User-Agent strings.
Why it matters
Verifiable automated-client identity can become an infrastructure layer for crawler and agent governance, allowing access policy to distinguish authenticated agents from unauthenticated traffic.
Visibility OS interpretation
Visibility OS treats authenticated crawler identity and authorization as infrastructure signals separate from retrieval, source selection, citation, answer inclusion and ranking. The draft does not establish a ranking benefit.
What remains uncertain
How broadly will AI crawler and agent operators adopt the protocol? Which publishers, CDNs and bot-management systems will enforce authenticated identity? How will the protocol change before RFC publication?