Anonymous credentials: rate-limiting bots and agents without compromising privacy

This report outlines a privacy-preserving approach to managing and rate-limiting AI-agent traffic on the web using anonymous credentials (ARC and ACT), comparing them to existing Privacy Pass mechanisms (blind RSA and VOPRF) and detailing trade-offs in communication, computation, revocation, and origin-binding. It explains core cryptographic building blocks (algebraic MACs, zero-knowledge proofs), presents concrete performance benchmarks, and demonstrates a prototype integration via the Model Context Protocol (MCP). The piece highlights current limitations (private verifiability, revocation granularity, parallelism) and explores potential paths forward (public verifiability, pairing-based schemes), calling for continued standardization at IETF/W3C and real-world experimentation.