Topic starter
21/10/2026 2:46 pm
TL;DR: Liveness checks and bot blocking are no longer enough because AI agents can appear legitimate while still acting beyond a user’s intent, especially in banking and ticketing, according to Alloy. The real control shift is from verifying presence to governing what an agent is authorized to do in each session.
Editorial analysis by NHI Mgmt Group, based on content published by Alloy: “Verify me… maybe? Why "bot or human" is about to be the wrong question”.
Key questions
Q: How should organisations govern autonomous agents that act on behalf of users?
A: They should require clear delegation, task-scoped permission, and continuous traceability back to a human creator.
Q: Why do bot detection controls struggle with AI agents?
A: Bot detection controls struggle because AI agents can behave like normal users or services while still acting independently.
Q: What breaks when liveness checks are treated as proof of trust?
A: Liveness checks only confirm that a real person was present at a point in time.
Practitioner guidance
- Define action-scoped delegation policies Separate read-only, low-risk, and high-risk actions so an AI agent can check balances but cannot move money or approve purchases without added controls.
- Bind approvals to session context Require the approval decision to include device history, location, requested action, and the agent’s declared purpose before permitting execution.
- Add step-up controls for high-impact transactions Trigger human confirmation when an agent requests payments, transfers, address changes, or other irreversible actions that exceed its normal pattern.
Bottom line: AI agents make bot or human a weak security question because valid login does not prove valid intent for later actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/10/2026 5:00 pm
Human-versus-bot verification is becoming a brittle control boundary. The article shows why login-time proof alone cannot answer the governance question that now matters most: who or what is authorised to act after authentication succeeds. Once an AI agent can inherit a valid session, the control problem shifts to delegated authority, not identity presentation. Practitioners should treat this as an access governance problem, not a fraud-only problem.
A question worth separating out:
Q: Should financial organisations use the same controls for customers and agents?
A: No. Customers, human delegates, and software agents represent different risk profiles and should not receive the same approval path. Human logins can rely more on identity verification, while agents need delegated authority limits, per-action policy checks, and stronger confirmation for transactions that change funds, ownership, or access.
👉 Read our full editorial: Why bot or human is becoming the wrong question for access