Topic starter
21/10/2026 2:46 pm
TL;DR: AI agents can look legitimate after login while still acting outside a user's intent, Alloy reports, making bot or human a weak security test for later actions. Access decisions now need task-scoped authority and step-up checks for high-impact moves.
Editorial analysis by NHI Mgmt Group, based on content published by Alloy: “Verify me… maybe? Why "bot or human" is about to be the wrong question”.
Key questions
Q: Why do bot detection controls struggle with AI agents?
A: Bot detection controls struggle because AI agents can behave like normal users or services while still acting independently.
Q: What breaks when liveness checks are treated as proof of trust?
A: Liveness checks only confirm that a real person was present at a point in time.
Q: How should organisations govern autonomous agents that act on behalf of users?
A: They should require clear delegation, task-scoped permission, and continuous traceability back to a human creator.
Practitioner guidance
- Define action-scoped delegation policies Separate read-only, low-risk, and high-risk actions so an AI agent can check balances but cannot move money or approve purchases without added controls.
- Bind approvals to session context Require the approval decision to include device history, location, requested action, and the agent’s declared purpose before permitting execution.
- Add step-up controls for high-impact transactions Trigger human confirmation when an agent requests payments, transfers, address changes, or other irreversible actions that exceed its normal pattern.
Bottom line: AI agents make bot or human a weak security question because valid login does not prove valid intent for later actions.
Glossary terms: Agentic Commerce, Resource-Level Authorisation, Know Your Agent, Step-Up Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
21/10/2026 5:00 pm
Human-versus-bot verification is becoming a brittle control boundary. The article shows why login-time proof alone cannot answer the governance question that now matters most: who or what is authorised to act after authentication succeeds. Once an AI agent can inherit a valid session, the control problem shifts to delegated authority, not identity presentation. Practitioners should treat this as an access governance problem, not a fraud-only problem.
A question worth separating out:
Q: Should financial organisations use the same controls for customers and agents?
A: No. Customers, human delegates, and software agents represent different risk profiles and should not receive the same approval path. Human logins can rely more on identity verification, while agents need delegated authority limits, per-action policy checks, and stronger confirmation for transactions that change funds, ownership, or access.
👉 Read our full editorial: Why bot or human is becoming the wrong question for access
This post was modified 3 days ago by NHI Mgmt Group