Agent Traffic Detection.
Agent traffic detection is identifying which sessions on a site or app are driven by AI agents, classifying the agent and its intent, and applying a policy (allow, limit, step up or block) instead of treating all automation as a bot.
Agentic trust is the umbrella vendors use for this; the underlying practice is detection followed by policy. The policy step is where CIAM comes in. Once a session is known to be an agent, the useful question is whose agent it is and what it was allowed to do, which is a Know Your Agent and consent question, not a bot-score question.
The vendor examples differ in where they sit. Transmit's Agentic Trust works across online channels for banks and merchants. WorkOS Radar applies at sign-in. Mastercard's probability score applies per payment. Sources: IDTechWire on Transmit Security Agentic Trust, Transmit Security agent intelligence, and WorkOS Radar docs.
Our reading. Do not make detection the only control. Detection is probabilistic, and well-behaved agents should be able to identify themselves and get a delegated grant instead. Use detection to catch the rest, and route agent sessions into the same risk engine as adaptive authentication. See bot defense for the baseline controls.
Common questions
What is agent traffic detection?
Agent traffic detection identifies sessions driven by AI agents, works out what kind of agent it is and what it is trying to do, and applies a policy such as allow, limit, ask the customer, or block. It replaces the older bot-or-human split with a decision about which agents to serve and how.
How is agent detection different from bot detection?
Bot detection usually aims to block automation. Agent detection assumes some automation is a legitimate customer's agent, so it classifies the agent and its intent before deciding. A shopping assistant acting for a signed-in customer and a credential-stuffing script both look automated, but they need different responses.
Can sites detect AI agents that do not identify themselves?
Vendors say they can, using device, behavioral and network signals, and Transmit Security says Agentic Trust detects agents whether or not they announce themselves. Accuracy claims come from the vendors. Agents that sign their requests, for example with Web Bot Auth, are far easier to handle reliably.
What should happen after an agent is detected?
Apply a policy per action, not per site. Reading a catalog may be allowed, adding a payment method may need the customer's approval, and changing account credentials may be blocked for agents entirely. Log the agent classification with the session so disputes can be investigated.
Related terms
In the guides
AI Fraud Detection in CIAM: Signup, Login, and Account Changes
Where fraud hits customer identity, which signals AI models score, and how to wire a fraud engine into signup, login, and account-change flows without wrecking conversion.
Bot Defense and Fraud Detection for Authentication Endpoints
Credential-stuffing bots, account-creation bots, scrapers, MFA-fatigue bots: the modern auth endpoint faces continuous automated attack. The defenses that hold and the ones that don't.
Know Your Agent: Identity for AI Agents That Buy on a Customer's Behalf
What a CIAM team must build when a customer's AI agent shows up at login, account, or checkout: delegated consent, agent sessions, step-up, audit, and revocation.