TL;DR: A shift from binary human-versus-bot detection toward intent-based trust decisions is emerging as AI agents act on behalf of legitimate users, and Arkose Labs was recognised by Forrester as a notable vendor in its Bot and Agent Trust Management Software Landscape. Conventional bot controls are no longer enough when access paths must preserve customer journey continuity and risk-based challenge decisions.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Arkose Labs's report: Market shift from bot detection to agent trust management centers on judging intent rather than simply classifying traffic as human or automated.
Why it matters: IAM, fraud, and identity teams need to understand this shift because delegated access paths from AI agents change how trust, challenge, and transaction protection have to be governed.
Context
Traditional bot management was designed to answer a binary question: is the traffic human or automated. That model breaks down when AI agents can act on behalf of legitimate users, because the security decision is no longer about classification alone. The real governance problem is whether the system can preserve trust across delegated access paths without blocking valid customer activity.
For identity and access teams, this is less about better bot labels and more about how trust is evaluated across the customer journey. The article frames agent trust management as a control pattern for deciding when to allow, challenge, or block activity when the actor may be an AI agent connected to a human principal.
Key questions
Q: How should teams govern AI agents that act inside customer accounts?
A: Treat them as delegated non-human identities, not as ordinary customer sessions. Governance should require explicit consent, narrow authorization scope, token binding, and a complete audit record tying each action back to the human principal that approved it.
Q: Why do binary bot controls fail when legitimate AI agents are involved?
A: Binary controls fail because they assume the main decision is human versus machine. Once an AI agent can act for a real customer, the security problem shifts to whether the action is authorised, contextual, and proportionate to the risk. A yes-or-no bot label is too blunt for that model.
Q: What signs show that bot detection is not enough for customer-facing AI traffic?
A: A common sign is when the same control both blocks valid customer transactions and misses suspicious automation that looks normal at the surface. Another signal is poor attribution, where analysts cannot trace activity back to a principal with enough confidence to make a trust decision.
Q: What is the difference between bot detection and agent trust management?
A: Bot detection asks whether traffic appears automated, while agent trust management asks whether the action should be trusted in context. The first is a classification problem. The second is a governance problem that combines principal attribution, intent visibility, and risk-based response.
Technical breakdown
Why binary bot detection fails for AI agent traffic
Binary bot detection assumes that the main security question is whether a session is automated. That assumption becomes weaker when an AI agent is operating on behalf of a legitimate user, because the system has to evaluate purpose, legitimacy, and behaviour, not just automation signals. In practice, the control surface shifts from device or script detection to trust decisions across a delegation chain. That creates a different identity problem: the actor may not be fraudulent, but the action may still be risky. Security teams therefore need to distinguish automation from authorised representation and from malicious automation.
Practical implication: move from simple bot classification to controls that evaluate delegated intent and session context.
Intent visibility and risk-based challenge decisions
Intent visibility means inferring what automated traffic is trying to accomplish so the control can respond proportionately. Risk-based challenge decisions use that context to decide whether a session should continue, be stepped up, or be blocked. This is materially different from fixed rules that treat all automation the same. The article’s framing aligns with customer journey protection because the same traffic may be legitimate in one transaction and hostile in another. For practitioners, the key issue is whether trust decisions are contextual enough to preserve conversions without creating blind spots for abuse.
Practical implication: define challenge logic around transaction context, not just traffic origin.
Customer journey continuity as an identity control problem
Customer journey continuity is not only a fraud outcome. It is an identity governance problem because the organisation must preserve the link between the human customer, the delegated agent, and the transaction being attempted. When that linkage is weak, security controls either over-block legitimate activity or under-block malicious automation. The article points to analytics, reporting, and custom detection models as the mechanisms used to keep that linkage visible at scale. That makes telemetry quality and principal attribution central to the control model, not secondary features.
Practical implication: ensure telemetry can tie agent activity back to the underlying customer principal.
Threat narrative
Attacker objective: The attacker seeks to abuse delegated access paths while staying inside the trust boundaries that conventional bot controls are meant to enforce.
- Entry occurs when AI agents operate through legitimate customer-facing access paths rather than obvious malware or credential theft.
- Escalation happens when the system treats all automation as equivalent and loses sight of the underlying principal and intent.
- Impact follows when malicious automation or abuse blends into normal customer activity and the organisation either blocks valid transactions or misses fraud.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Bot detection is giving way to trust governance. The market is moving because traffic classification alone cannot answer the real question anymore: what is the actor trying to do, and on whose behalf. That shift matters because AI agents collapse the old separation between automation and legitimate customer activity. Security teams should treat trust evaluation as part of identity governance, not as a narrow anti-bot function.
Intent visibility is becoming the new decision boundary. If a platform cannot explain what a session is attempting to do, it cannot support proportionate challenge decisions. That changes the control objective from blocking automation to governing delegated actions across the customer journey. Practitioners should expect this pattern to influence fraud operations, IAM, and transaction security together.
Customer attribution is now a governance requirement, not a reporting nicety. When AI agents sit between the customer and the application, identity programmes need a durable way to connect the action back to the principal. Without that linkage, organisations either over-challenge good traffic or create a blind spot for abuse. The practical conclusion is that attribution and trust scoring belong in the same control conversation.
Legacy bot controls assume the wrong unit of analysis. Those controls were designed for whether a session was scripted, not whether it was authorised representation. That assumption fails when an AI agent can pursue a legitimate user objective through a delegated path. The implication is that organisations must govern the relationship between actor, intent, and transaction, not just the presence of automation.
From our research library:
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
- Read next: Agentic AI Identity Guide
What this signals
Delegated traffic changes the unit of governance. Once an AI agent can act for a customer, the old bot-management model is too coarse for security decisions. Teams need controls that can preserve principal attribution across the session, otherwise they will either over-challenge legitimate activity or under-detect abuse.
Intent-aware trust is becoming a programme issue, not just a fraud-control feature. The practical boundary is shifting from whether a session is automated to whether the platform can explain what the session is trying to do. That pushes IAM, fraud, and customer protection into the same decision layer.
Customer journey continuity is the named control problem. If identity controls cannot follow the human principal through an AI-mediated interaction, the organisation loses both trust precision and incident clarity. The result is a weaker governance model for transactions, account protection, and delegated access.
For practitioners
- Define delegated-traffic trust policies Separate legitimate AI-assisted customer activity from hostile automation by policy, not by a single bot score. Tie allow, challenge, and block decisions to transaction context, principal attribution, and observed intent.
- Map customer principals to agent-mediated sessions Preserve a traceable relationship between the human customer and any AI agent acting for them so investigations and risk decisions can follow the same identity chain.
- Use telemetry to drive risk-based challenges Instrument the journey so analytics can distinguish account takeover, toll fraud, and legitimate delegated activity before the control fires.
- Re-evaluate bot controls around transaction assurance Review where existing bot management blocks valid customer actions because it cannot see intent, and where it allows abuse because it only recognises automation signatures.
Key takeaways
- Binary bot detection is too narrow when AI agents act for legitimate users, because the real decision is whether delegated activity should be trusted in context.
- The article frames intent visibility and customer journey continuity as the practical problems behind trust management, not traffic classification alone.
- Identity teams need attribution, risk scoring, and challenge logic that can follow the human principal through AI-mediated access paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents acting on behalf of users create identity and privilege questions central to this article. |
| ASI09 — Human-Agent Trust Exploitation | The article centres on trust decisions where AI traffic represents human customers. | |
| Recommendation — Apply ASI03 to govern delegated agent actions and verify what the agent is authorised to do. Use ASI09 to test where trust assumptions break in human-facing agent workflows. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | Trust management for AI agents depends on governance, accountability, and oversight decisions. |
| Recommendation — Establish governance and accountability for AI-mediated customer interactions under GOVERN. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Delegated access paths still require authorisation decisions and entitlements control. |
| Recommendation — Use PR.AA-05 to align delegated access decisions with least-privilege authorisation. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | Fraud and token abuse patterns tie this topic to credential access and exfiltration behaviour. |
| Recommendation — Map suspicious delegated-session abuse to TA0006 and TA0010 for detection and hunting. | ||
Key terms
- Agent Trust Registry: A registry is a structured control record for AI agents that captures identity posture, trust signals, and governance metadata before production approval. In practice, it turns agent review into a repeatable decision process rather than a one-off judgment based on vendor claims or informal owner knowledge.
- Intent Visibility: Intent visibility is the ability to infer what a delegated actor is trying to do from its sequence of actions, timing, and context. In practice, it gives security and fraud teams a way to distinguish legitimate automation from abuse when source-based classification is no longer enough.
- Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.
- Customer Journey Continuity: Customer journey continuity is the ability to maintain a consistent, trusted view of a customer across different access methods and interaction layers. For identity teams, it means controls must follow the principal through direct and agent-mediated sessions without breaking legitimate activity.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org