Moving past bots vs. humans

This essay examines how web protection and bot management must evolve as the line between human users and automated clients blurs, describing passive and active client signals, the rate-limit trilemma (decentralized, anonymous, accountable), and privacy-preserving primitives such as Privacy Pass, Anonymous Rate-Limit Credentials (ARC), and Anonymous Credit Tokens (ACT). It argues for an open issuer ecosystem and browser/agent-level APIs that enable proving behavior without revealing identity, warns of risks if anonymous proofs gate access, and recommends designing systems that preserve broad access to the open Web.