Moderation of unLinkable Endorsements
MOLE (Moderation of unLinkable Endorsements).
MOLE is a proposed IETF architecture in which a site (the Moderator) trusts a client because a third party (the Anchor) endorses it, and adjusts that trust over time, without being able to link the client's visits.
MOLE answers a narrow but growing question: how can a site rate-limit and moderate a client it should not identify? Today the usual answers are an IP address, a device fingerprint, or an account. The first two are weak and invasive; the third forces sign-up. MOLE lets a party that already knows the user, such as an account provider or an agent operator, vouch for them, while the site that enforces the limit learns only that someone trustworthy vouched.
That is why Cloudflare's Trusted Agent Delegation post cites it for the lower identification tiers. For agents, the attraction is that a user's agent can be throttled or cut off for bad behavior without the site ever learning the user's identity. Sources: draft-jms-mole-architecture-01 and the protocols draft.
Our reading. Nothing here is deployable as a standard yet, so do not plan a launch around it. It is worth tracking because it changes what a CIAM team may be asked to be: an Anchor that vouches for its own customers to other sites. For today's tools, see bot defense and rate limiting.
Common questions
What is MOLE in identity and agent security?
MOLE (Moderation of unLinkable Endorsements) is a proposed IETF architecture that lets a site trust a client because a third party vouches for it, then raise or lower that trust based on behavior, without the site or the voucher being able to track the client across visits. It is described in individual drafts named draft-jms-mole-*.
How is MOLE different from Privacy Pass?
Privacy Pass (RFC 9576) lets a client prove it passed a check without being identified, but it has no privacy-preserving way to bootstrap trust from an existing relationship and cannot adjust trust over time. MOLE adds both: Anchors endorse clients they know, and Moderators update Credentials in response to behavior. Cloudflare's TAD post calls MOLE the intended successor to Private Access Tokens.
How does MOLE apply to AI agents?
The architecture draft covers user agents acting under delegation: an agent can present a Credential for the user without exposing a stable identity, and the Moderator can update that Credential if delegated behavior breaks policy, so the user bears the consequence. Agents may also use a separate pool of Anchors so sites can tell them apart from ordinary browsers.
Is MOLE an IETF standard?
No. As of November 9, 2026, the MOLE documents are individual Internet-Drafts with no formal IETF standing, and the protocols draft calls its protocols provisional. Treat them as work in progress.
Related terms
In the guides
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Bot Defense and Fraud Detection for Authentication Endpoints
Credential-stuffing bots, account-creation bots, scrapers, MFA-fatigue bots: the modern auth endpoint faces continuous automated attack. The defenses that hold and the ones that don't.
DDoS and Rate-Limiting for Authentication Endpoints
Login endpoints are the highest-leverage target for volumetric attacks: small request size, large server cost, identity-system disruption. The composite defense pattern that scales.