What the Wall Is Actually For
I don't know about you, but I almost never just do a web search any more--it's agents all the way down nowadays. So when someone asked me about a new initiative called PACT, I pointed the agent at it and went to grab a drink. It came back with the Mozilla engineering blog, a Cloudflare press release, an EFF post from 2019, an IETF RFC -- the primary sources and the skeptical ones, sourced and dated. Real work. The kind a research assistant does. It just happened to be a bot doing it.
What bugs me, is that if I point that same agent at a paywalled newspaper or an ad-wrapped fan wiki and it hits a wall. Same software, same question, same human -- me -- sitting here waiting for the answer. One door opens, the other slams, and the thing deciding which is not whether a person wants the information. It's whether the client asking looks like a person.
I wrote about this in March, in We Are All Becoming Bots. Back then it was anecdotes: Cloudflare blocking me from dairyqueen.com because my work traffic egressed through a corporate proxy; a Star Trek wiki throwing a JavaScript challenge at my agent when I tried to confirm whether a line about ripping the iron out of your blood cells was real canon (it is). Annoying, ad hoc, the texture of a web that had started treating me as a robot. This week those ad hoc walls got a name and a standards track.
The Wrong Question
The number everyone leads with is that 58% of web traffic is now bots. Cloudflare says so, and Cloudflare would know -- it sits in front of a large fraction of the web. It also sells the thing that number justifies, so hold that thought.
Take the 58% at face value and notice what it actually measures. It is not a measure of abuse. It is a measure of a category breaking. Of course automated traffic is climbing. Legitimate, wanted, human-directed work now looks exactly like a bot, because it is one. My research agent is in that 58%. So is anyone who asked an assistant to book a flight, summarize a contract, or check a fact this year.
The web has spent thirty years building on one equation -- clicks = revenue -- and that question just stopped meaning what it used to. Agents don't have eyeballs and don't misclick on the popups or inline ads. There is a misalignment with the incentives behind hosting data, and the agentic paradigm is breaking the revenue structure.
Advertising monetizes attention. Agents minimize attention.
Enter PACT
On June 22nd 2026, Cloudflare, Mozilla, Google, Microsoft, and Shopify announced Private Access Control Tokens -- a proposal to replace the CAPTCHA-and-fingerprint mess with something cleaner. (Apple, which shipped its own version of this idea -- Private Access Tokens -- years ago, is not on the list. Hold that thought too.) It builds on Privacy Pass, a real IETF standard, and the cryptography is genuinely clever. An Anchor vouches that you're a real account in good standing. A Moderator turns that into a token. A site checks the token. And -- the elegant part -- none of them can link the token back to you. You stop solving puzzles. Nobody tracks you across sites.
Let's be clear, bot abuse is real. CAPTCHAs are miserable and fingerprinting is worse -- it's surveillance wearing a security badge. And PACT deliberately avoids the trap Apple fell into, where proving you were a person meant owning a recent iPhone with the right hardware chip. Tying the right to use the web to a specific vendor's hardware is exactly the dystopia you'd want to design around. PACT deftly designs around it.
Then the turn. PACT still can't see intent. It can only see credentials. It answers "is a person being served?" with "does this client carry a token from someone we trust?" -- and "we" is Cloudflare and three browser makers. Who qualifies as a trusted Anchor is unwritten, and the design has a property where the weakest trusted Anchor sets the floor for everyone, which quietly pushes the whole system toward a small set of big, blessed vouchers. Eric Rescorla, who helped write the encryption that secures the modern web, made exactly this objection about Apple's version back in 2023: build this, and sites can get a lot more aggressive about turning away anyone outside the approved ecosystem.
The tell is simple. It will work beautifully for OpenAI's agent and Google's agent. The first deployments are likely to favor agents backed by organizations that can become trusted Anchors. Whether independently operated agents will have an equally practical path remains an open question.
Legitimacy stops being something you have and becomes something you're issued.
The Wall
It's worth asking what the wall protects, because it isn't you. Go back to that fan wiki. Fandom takes content other people wrote, for free, wraps it in advertising, and uses Cloudflare to make sure you arrive through the door that shows you the ads. Wikipedia hosts the same kind of content and hands a clean page to an honest bot without blinking, because Wikipedia doesn't need your eyeballs to fire an ad impression. Same content, opposite policy, and the only variable is the business model. The wall isn't there to protect you from garbage. It's there to protect the thing that monetizes you.
That model assumed the eyeball and the reader were the same person. Agents just severed them.
The colleague who first asked me about PACT works in the same space I do -- my $dayjob is in security at an ISP -- and their real question was whether PACT would stop residential proxy abuse. It won't. The tokens would just be proxied through, the same way AI-solved CAPTCHAs are today. Another layer of complexity that real abuse routes around and legitimate traffic has to climb over.
The Enclosure, Again
There's a pattern I keep walking into. In The Third Enclosure I argued that every time we free something -- knowledge, code, distribution -- a new fence goes up one layer down, around whatever turns out to be scarce next. I ended that piece wondering where the next fence would form. Here's an answer I didn't expect this soon: around legitimacy itself. Not the data, not the model -- the right to be treated as a real participant in the web. That right is becoming a credential, privately issued, by the companies most invested in the old aperture.
Each liberation becomes the next enclosure.
Population: Me
The honest hedge, because something does have to be built. The abuse is real, doing nothing is not a plan, and unlinkable tokens genuinely beat fingerprinting on the axes I care about -- cross-site tracking, identifiability, surveillance. The axis they lose on is access: fingerprinting lets anyone through and then challenges them; PACT can exclude you before you arrive. If an open, plural set of Anchors emerged -- if the agent I run myself could get vouched for by someone other than a hyperscaler -- I'd be writing a different post.
This has happened before. HTTPS once required a certificate from an approved Certificate Authority -- and those CAs charged hundreds of dollars a year for the privilege. Small sites either paid up or ran plain HTTP and wore the "Not Secure" label. Let's Encrypt arrived in 2016, automated the whole thing, and the gate fell. But it took a decade and a dedicated nonprofit -- backed by Mozilla, the EFF, and Cisco -- to build the thing that opened it. PACT is a gate of exactly the same shape, one layer up. The question is whether there's a Let's Encrypt for legitimacy.
That ecosystem doesn't exist yet, and the people drafting the standard are the people who profit from the gate.
In March I ended with: welcome to Botland, population me. The update is that Botland is getting a border. They're issuing passports now, and a handful of companies run the office.
The optimist in me suspects there's another path -- one that routes revenue to the people who made the thing worth reading, rather than the people who built the wall around it. PACT, as it looks to me right now, isn't it.
James is a security engineer who now does a good deal of his reading through agents, and is increasingly aware of which doors quietly close when he does. This post was researched, in part, by one of those agents -- the same kind the new web wants to card at the door. Written in collaboration with Claude.
Discussion