Machine customers are not bots

For years, online retailers have treated automated traffic as a problem to block. Scrapers copy catalogs, credential stuffing attacks test passwords, and scalper bots empty inventory. The reflex to keep automation out is earned. It is also about to collide with a new kind of automated visitor that a store wants to serve.

Two different intents

A bot acts for itself or for someone who wants to take value from the store. A machine customer acts for a real buyer who wants to give the store money. The traffic can look similar: no browser history, fast requests, no mouse. The intent is opposite.

Why blocking everything fails

A store that blocks all automated visitors will also block the agents that would have bought from it. A store that allows all of them will invite abuse. Neither is good.

What a better line looks like

• Agents that identify themselves and the person they act for.
• Limits on what an agent may buy without a person approving.
• Rate limits tuned for shopping, not for scraping.
• Fraud checks that look at the purchase, not only at whether a human is present.

An open problem

None of this is settled, and we do not think one party should decide it alone. It is the kind of question public benchmarks and open conformance tests can help with, because merchants, agent builders and payment providers each need to see the same results.