Proving Humanity

What it claims

The essay says agent identity on today's web ends one step before a person. Cloudflare's Web Bot Auth attests to the platform running an agent. Google's AP2 attests to an account key. Neither can show that 1,000 accounts are not one person. It argues the missing layer is an anonymous proof that a distinct person exists, and that it must be built now, "when machines can still sometimes be caught." If it waits, blunt KYC-everywhere becomes the default. The author states up front that it describes or evaluates no proof-of-personhood project, so it gives you a problem statement and requirements, not a candidate to adopt.

How it works

Where each existing mechanism stops, as the page describes it:

flowchart LR
  A[Agent request] --> S[Web Bot Auth signature]
  S --> P[Hosting platform identified]
  A --> M[AP2 intent + cart mandates]
  M --> K[Account key identified]
  P --> R[Platform account records]
  R -.after the fact, needs cooperation.-> X{Distinct person?}
  K -.not established.-> X
  H[Agent on owner's hardware] -.no platform, no records.-> X
  X --> PoP[Proof of personhood credential]

Details the summary omits:

• Cloudflare "signed agents" are a category for agents directed by end users, where the hosting platform signs requests. The signature tells a site which company's software is calling, not which user.
• AP2 has two kinds of mandate. An intent mandate records the request and its limits. A cart mandate records approval of a specific purchase. AP2 also separates user-present transactions from deferred ones executed under pre-signed rules.
• Platform logs are the fallback. They are private, available only after the fact, and tied to accounts. They do not exist for self-hosted agents. The page names Nous Research's Hermes as an example of such an agent.
• Agency-law framing. Signed agents correspond to an "unidentified principal," which the law tolerates because the human agent in the middle is liable. An AI agent cannot be liable, so something must guarantee the principal "cannot simply start over."
• Per-person limits. A limit set per account "can be multiplied away." A limit set per person cannot. This is the practical design consequence for anyone running quotas, trials or airdrops.

Why per-provider KYC fails, per the page:

1. It multiplies data exposure across every agent provider.
2. It excludes people who cannot pass KYC.
3. It still cannot deduplicate across providers without pooling records.

The proposed alternative is to verify once and present the credential through any agent.

Evidence

The figures are cited from third parties, not produced by the author:

• CAPTCHAs: an ETH Zurich 2024 study had an off-the-shelf detector solve all reCAPTCHAv2 image challenges. It also found v2 leaned on cookies and browsing history.
• Traffic share: Imperva measured automated traffic at over 53% of web traffic in 2025, up from 51%. Cloudflare Radar showed 57.5% of HTML traffic automated as of June 2026, about 18 months ahead of the Cloudflare CEO's forecast.
• Fake comments: of 22M FCC net-neutrality comments in 2017, about 18M were fake. They were caught through bulk patterns and recycled text.
• Ad fraud: Juniper estimates 22% of 2023 ad spend, about $84B, was lost to fraud, rising to a projected $172B by 2028. The author flags these vendor estimates as only "indicative."
• Agent capability: autonomous task length at 50% reliability doubles roughly every 7 months. The author calls this "narrow" and possibly not generalizable.

Limits

• ChatGPT Agent passing Turnstile is called an anecdote, not proof.
• Unknown legitimate share: no one knows what fraction of agent traffic is legitimate delegation.
• Residual trust: a proof-of-personhood credential still needs a trusted issuer that keeps nothing it shouldn't.
• Credential resale: credentials can be rented or sold, which weakens the one-person guarantee.
• Scope: it does nothing for alignment or misuse by verified humans, and it does not establish truthfulness.
• Author interest: Galaxy Digital discloses it may hold financial interests in assets discussed. Weigh that, given the crypto-adjacent proof-of-personhood field the essay sets up.