News

Proof of Human: Why Bot Detection Moved to the Login Layer in 2026

Moca Network

August 31, 2026

Proof of human is the practice of establishing that a distinct, real person is behind an interaction, as opposed to an automated script, a synthetic identity or an AI agent acting without authorisation. In August 2026 it stopped being a research topic and became a procurement line item: a United States federal agency issued a sourcing requirement for technology to block "account takeovers, synthetic identities, and automated agentic AI threats" on the government's own sign-on service.

When a government names AI agents in a technical requirements document for authentication, the category has moved from thesis to budget.

Key takeaways

A US federal authentication service is sourcing device-intelligence technology explicitly to counter automated agentic AI at login.
A parallel policy proposal would make that service the default sign-on across all public-facing federal websites, with agencies given 60 days to inventory authentication methods and six months to complete identity risk reviews.
The national standards body published guidance the same week arguing that agentic AI requires a strong identity foundation.
Enterprise identity platforms shipped first-class agent identity into general availability in the same period.
The unresolved question is no longer whether agents need identity, but how a system distinguishes an authorised agent from an unauthorised one, and both from a human.

The three-way classification problem

Authentication was built around a binary: legitimate user or attacker. Agentic AI breaks that model, because a system now has to distinguish between three states that all present valid credentials.

Actor	Credentials	Should it be allowed?
The human account holder	Valid	Yes
An AI agent the account holder authorised, acting inside its mandate	Valid, delegated	Yes, within scope
An AI agent acting outside its mandate, or an attacker's automation using stolen credentials	Valid, or valid-looking	No

Traditional bot detection cannot resolve this, because it was designed to answer "is this automated?" and the answer for the middle row is yes. Blocking all automation blocks legitimate delegated activity. Allowing all credentialed access allows the third row.

The requirement that emerges is therefore not bot blocking but actor classification with delegation semantics: who is acting, on whose authority, within what bounds, and can that be verified independently of the credential itself.

Why this became urgent in 2026

Three forces converged.

Agents became transactional. Once an AI agent can hold a wallet, sign a payment and complete a purchase, the cost of an unauthorised agent stops being a data problem and becomes a financial one. Authorisation scope becomes a control, not a preference.

Synthetic identity got cheap. Generating a plausible identity, a face, a document image and a behavioural profile now costs almost nothing. Signals that were once expensive to fake, and therefore load-bearing in a risk model, no longer carry weight.

Volume made manual review impossible. Agent traffic does not queue politely. Any control that depends on a human reviewing an edge case fails at agent scale.

The result is that identity infrastructure is being asked for a property it was never designed to provide: a durable, verifiable assertion that a unique human being exists behind an account, that survives the account being delegated to software.

What a credible proof-of-human control looks like

Four properties separate a working control from a checkbox.

Uniqueness, not just liveness. A liveness check confirms a real person is present at that moment. It does not confirm that this person has not already created four hundred other accounts. Uniqueness requires a durable link back to a single verified individual.
Delegation that is explicit and bounded. When a human authorises an agent, that authorisation should be a verifiable object with a scope, an expiry and a revocation path, not an inherited session token.
Privacy that survives the control. A proof-of-human system that requires every service to hold a biometric template creates a larger problem than the one it addresses. The assertion should be verifiable without the verifier receiving the underlying data.
Portability. If every service builds its own proof-of-human silo, users face endless re-verification and attackers only need to find the weakest implementation.

The fourth property is the one most often skipped, and the one that determines whether the control holds at ecosystem scale.

Credentials as the delegation primitive

A verifiable credential model addresses the three-way classification problem directly, because it separates three things that password-based authentication conflates: the subject, the holder and the authority.

A human is verified once and holds a credential proving unique personhood. When that human delegates to an agent, the agent receives a scoped, time-bound credential that references the human's proof without reproducing it. A service asked to authorise an action can then verify three assertions independently: that a unique human stands behind the request, that the acting party holds a valid delegation, and that the requested action falls inside its scope.

AIR Identity implements this pattern using zero-knowledge proofs, so a verifying partner confirms the assertion without receiving the underlying identity data. Combined with AIR Money for programmable settlement, an authorised agent can transact within limits that are enforced cryptographically rather than by policy convention.

For platforms whose economics depend on distinguishing real users from automation, particularly in advertising and audience monetisation, that distinction is the product, not a security feature.

Frequently asked questions

What is proof of human?

Proof of human is a verifiable assertion that a distinct, real person exists behind an account or interaction. It is stronger than a liveness check, which confirms only that a person is present at a given moment, because it also establishes uniqueness: that this person is not operating many accounts, and has not been synthetically generated.

How is proof of human different from CAPTCHA?

CAPTCHA tests whether a session can complete a task that was historically hard to automate. Modern automation passes these tests routinely, and legitimate delegated agents fail them. Proof of human instead relies on a verified credential tied to a single individual, which does not degrade as automation improves and which can be delegated deliberately rather than defeated incidentally.

Do AI agents need their own identity?

Yes. An agent acting on a user's behalf needs an identity distinct from the user's, so that its actions can be scoped, audited and revoked without disabling the user's own access. National standards guidance published in August 2026 makes exactly this argument: agentic AI requires a strong identity foundation, including delegation records that can be verified independently.

Can you verify a human without collecting biometric data?

Yes. A trusted issuer can perform the verification once and issue a credential. Subsequent verifiers receive a zero-knowledge proof of the assertion rather than the biometric itself. The biometric never propagates across the services relying on it, which both reduces breach exposure and keeps the control usable under data protection law.

What is delegated authorisation for AI agents?

Delegated authorisation is a verifiable record that a specific principal granted a specific agent permission to perform a bounded set of actions for a bounded time. It differs from sharing credentials because it is scoped, independently verifiable and revocable without changing the principal's own credentials.