What Proof of Actor means
Proof of Actor is the product AgentCredia builds for teams that operate applications, websites, APIs and MCP servers. It answers a question that account login alone does not: who or what is acting in this interaction right now? A signed-in account can be driven by a person clicking through the interface, by a person working alongside an AI assistant, or by an autonomous agent operating on its own. Proof of Actor gives the application evidence about which of those it is looking at, and leaves the response to the application.
The product is organized around three capabilities:
- Detect gathers the actor signals available to the integration and separates verified assertions from behavioral inferences.
- Understand turns those results into analytics: actor mix by route, trends over time, and the evidence behind each classification.
- Route lets the application apply its own policies to allow, adapt, challenge, review or limit specific interactions.
Why it matters
Applications were built around the assumption that a human sits behind every session. That assumption no longer holds. AI agent traffic now reaches product pages, APIs and tool servers, and people increasingly use AI assistance while they work inside an app. Treating all of it the same way leads to two bad outcomes: legitimate automation gets blocked by defenses designed for abuse, and sensitive actions get performed with less context than the team assumes.
Proof of Actor gives product, platform and security teams a shared view of what is actually happening, so decisions are based on evidence rather than guesswork.
How it works
Every interaction that passes through a supported integration receives a result with two parts:
- A class: Human, Human + AI, Agent or Unknown.
- A basis: verified, declared, inferred or unknown, which states what the class rests on. See evidence basis.
A request carrying a valid HTTP message signature (RFC 9421) is a verified agent identity. A client that names itself as an agent is a declaration. Interaction patterns consistent with a person at a keyboard are an inference. When the evidence does not support a determination, the result is Unknown, and it stays Unknown. The four classes are explained in Human, AI-assisted or agent: a practical taxonomy for application traffic.
Teams start in observation mode. Results are recorded and reviewed against real outcomes, and nothing about the application's behavior changes. When a team is confident that a policy fits a workflow, it enables that policy in its own code. The full flow is described on How It Works.
Common misconceptions
It is not a bot blocker. Proof of Actor does not block anything by default. Many agents are welcome participants, and the right response to them is often a structured API rather than a challenge page.
It is not identity verification. A Human result means the observable signals indicate human-directed interaction. It does not identify the person.
A signed agent is not an authorized agent. A valid signature proves that a request was signed with a key tied to a published identifier. Whether that operator may perform an action in your application is an authorization decision your app makes.
How Proof of Actor fits your stack
Proof of Actor sits beside your existing authentication and authorization. It adds actor context; it does not replace your login, your permissions model or your judgment about risk. The application owner decides enforcement, route by route, with explicit fallbacks for Unknown results and timeouts.
Read the product overview, review what the evidence can and cannot establish, or apply for early access to join the founding developer program.
Sources
- RFC 9421: HTTP Message Signatures: the standard behind verified agent identity