Proof of Actor: understand who's acting in your application.
Proof of Actor by AgentCredia is one product for actor visibility and application-defined decisions. See what each interaction is, the evidence behind it, and choose the right experience for it.
GET /api/v1/catalog
Evidence
Request signature validated for sample-crawler.example
Your policy: Allow: serve the structured API response
Why actor context matters
A login tells you which account is in use. It does not tell you whether a person is clicking, a person is working with an AI assistant, or an autonomous agent is acting through the account. Those deserve different experiences.
Proof of Actor adds
An assistant is acting through this account on /reports.
01 · Detect
Collect the signals your integration can see.
Proof of Actor gathers actor signals at the server, the edge, in the browser or in your MCP server, and separates verified assertions from behavioral inferences.
- Verified agent identities from request signatures.
- Client declarations and in-app AI disclosures.
- Browser interaction signals where your collector runs.
- Unknown kept as its own result, never guessed.
- Request signaturevalid · sample-crawler.exampleverified
- Client declaration"research-assistant/2.1"declared
- Browser interactionpointer + keyboard eventsinferred
- No supported signalsroute not instrumentedunknown
02 · Understand
See who is using each part of your app.
Actor analytics by route and workflow show where people, AI-assisted users and agents interact, with the evidence for every classification one click away.
- Traffic mix by route, workflow and time period.
- Evidence and basis behind every result.
- The unknown rate, so you know where coverage ends.
- /dashboardUnknown 7%
- /api/v1/catalogUnknown 15%
- /support/ticketsUnknown 8%
- /signupUnknown 21%
03 · Route
Decide what happens next, route by route.
Write policies for the routes that matter: allow, adapt, challenge, review or rate-limit. Start in observation, preview the effect, then enforce when you are ready.
- Policies per route, actor class and basis.
- Observe, preview, then enforce.
- Explicit fallbacks for Unknown and timeouts.
- Decisions stay in your application code.
- /api/v1/catalogenforceAgentAllow · structured API
- /support/ticketsenforceHuman + AIAllow · label AI-assisted
- /account/*previewUnknownKeep existing checks
- /api/v1/orderspreviewAgentRequire stronger credential
Four classes. Every result explained.
Every interaction resolves to one of four classes, each with a clear meaning and a clear limit.
- Human
The supported observable signals indicate human-directed interaction.
Does not mean: That no AI was used, or that the person's real-world identity is verified.
- Human + AI
AI assistance was declared, or detected by a supported integration that can actually observe it.
Does not mean: That all hidden AI use can be detected, including another tab or another device.
- Agent
Automated or agent-origin interaction, supported by verifiable identity or a carefully qualified inference.
Does not mean: That the agent is authorized, safe, or acting with valid delegation from a person.
- Unknown
The available evidence does not support a reliable determination.
Does not mean: That the interaction is suspicious or malicious.
And every result states its basis
- verifiedA cryptographic or otherwise checkable assertion validated, for example a request signature against a published key. It proves that check, nothing more.
- declaredThe actor or your application stated it, for example an AI-assistance disclosure or a client that names itself as an agent. A declaration can be untrue.
- inferredA conclusion drawn from behavioral or contextual signals. Inferences can be wrong and are always labeled as inferences.
- unknownNot enough evidence for a determination. The result is reported as Unknown rather than guessed.
Decisions your app can make
Three common situations, from request to result to your decision.
A signed agent reads your catalog
Request
GET /api/v1/catalog
Result
Agentbasis: verifiedYour decision
Serve the structured API instead of HTML pages.
An account change with no evidence
Request
POST /account/password
Result
Unknownbasis: unknownYour decision
Keep the existing re-authentication flow. No actor-based decision.
A disclosed AI-assisted ticket
Request
POST /support/tickets
Result
Human + AIbasis: declaredYour decision
Accept it and route it with an AI-assisted label.
Built for production apps
Observation first
Installing Proof of Actor changes nothing until you enable a policy.
Evidence, not scores
Results carry their basis instead of an unexplained number.
Your rules
Enforcement lives in your application, per route and risk tier.
Privacy by design
Minimal collection, tenant isolation and retention you agree.
Fits your stack
Server middleware, Next.js, the edge, the browser, a generic HTTP API and MCP servers.
- Founding teams
Web server middleware (Node.js)
Server-side
Request-level signals for server-rendered apps and APIs.
- Founding teams
Next.js
Server-side and edge
Middleware for page and API routes.
- Founding teams
Browser script
Browser signals only
Interaction signals from browser sessions, alongside a server-side integration.
- Founding teams
Cloudflare and edge runtimes
Edge
Signals at the edge before requests reach your origin.
- Founding teams
Generic HTTP API
Any stack
Send request context to an API and receive a result with its basis.
- Founding teams
MCP server
MCP
Actor context for MCP tool calls.
- Roadmap
WordPress
Plugin
Plugin for WordPress sites.
- Roadmap
Native mobile
iOS and Android
Native iOS and Android SDKs.
Integrations are delivered hands-on with each founding team during onboarding. Using a different stack? Tell us when you apply.
Frequently asked questions
Is Proof of Actor a bot blocker or a CAPTCHA?
No. It reports actor evidence and classifications and leaves decisions to your application. It does not block anything by default.
Does it verify a person's identity?
No. It does not perform identity checks, KYC or biometric verification. A Human result means the observable signals indicate human-directed interaction, not who the person is.
Does a signed agent request mean the agent is allowed to act?
No. A valid signature associates a request with a key and its published operator. Whether that operator may do something in your app is your authorization decision.
How do I get access?
Proof of Actor is in private beta. Apply for early access and tell us about the application and the interaction you want to understand.
Know who's using your app.
Apply to join the founding developer program.
Prefer to talk first? Talk to the founders