AI agents are changing the way the web is used.

gibrancorbin11-hub — Mon, 05 Oct 2026 01:00:40 +0000

AI agents are changing the way the web is used.
Most infrastructure still assumes that the thing requesting your API, data, content, or service is either a human or a traditional bot.
That assumption is starting to break.
An AI agent can search a site, call an API, invoke a tool, consume proprietary data, trigger compute, and eventually make a payment — all without a human directly making each request.
That creates a new infrastructure problem:
Who is this agent?
Can I verify it?
What should it be allowed to access?
How much is it consuming?
Should that interaction be free or paid?
Those questions are why I built Wayleave.
What is Wayleave?
Wayleave is an independent control layer between AI agents and the infrastructure they interact with.
The basic model is:
Identify → Verify → Authorize → Route → Meter → Monetize
The goal isn't to replace your CDN, cloud provider, API gateway, database, payment processor, or application.
Wayleave is designed to work with the stack you already have.
Think of it as a policy and economic layer for agent traffic.
Why I think this matters
The web has spent decades building infrastructure around human users.
Authentication tells us who a user is.
Authorization determines what that user can do.
Rate limits control consumption.
Analytics measure behavior.
Billing handles economic relationships.
But autonomous agents introduce another participant into that system.
A business may want a human to read something for free while treating an automated agent consuming the same information differently.
Or it may want to allow one verified agent, rate-limit another, block suspicious automation, and charge an agent accessing a high-value API.
That shouldn't require rebuilding the entire application.
What Wayleave does
Wayleave is being built around three primary pieces:
Core
Core handles agent identity, classification, policies, permissions, and access decisions.
The important distinction is that Wayleave doesn't pretend every automated request can magically be identified.
Traffic can have different levels of trust.
When Wayleave can verify something, it can treat that differently from something that merely declares itself to be an agent or traffic that only appears automated.
For infrastructure, I think that distinction matters.
Meter
Once access is allowed, Wayleave can meter what is actually being consumed.
That creates the foundation for:

usage limits
analytics
rate policies
usage-based pricing
paid routes
agent-to-service commerce Instead of treating monetization as a separate system, the economic decision can follow the access decision. Build I'm also working on Wayleave Build to make it easier to create and deploy applications with Wayleave's control layer built into the workflow. The broader goal is simple: Developers should be able to build for an internet where humans and autonomous agents coexist. Why not just use Cloudflare, AWS, Stripe, or x402? I don't think Wayleave needs to replace any of them. That's actually the point. Cloudflare can provide edge infrastructure. AWS can provide compute and services. Vercel can host applications. Stripe can handle payments. MCP can expose tools. Protocols such as x402 can help enable machine payments. Wayleave's thesis is that businesses will still need an independent control plane across those systems. Payment alone doesn't answer: Who gets access? Before a transaction happens, something needs to identify the requester, establish trust, apply policy, authorize the interaction and measure consumption. That's the layer I'm building. Humans free. Agents identified. Value unlocked. One principle behind Wayleave is that this isn't about making the internet hostile to AI. I believe AI agents are going to become an important part of how software and the web work. The question is how businesses participate sustainably. If an autonomous system is repeatedly consuming expensive compute, proprietary information, API calls, tools, or other valuable resources, the business providing those resources should have visibility and control over that relationship. Sometimes the right policy will be free. Sometimes it will be limited. Sometimes blocked. And sometimes paid. The infrastructure should make that decision possible. I'm building this in public Wayleave is early. I'm a solo founder, and I'm deliberately not pretending every problem around agent identity and machine commerce has already been solved. What I can do is build, test, publish, learn, and improve quickly. I'd particularly like feedback from developers building:
APIs consumed by agents
MCP servers and tools
AI applications
proprietary data services
developer platforms
usage-based products
agent infrastructure If you're already seeing meaningful agent traffic, I'm especially interested in hearing what problems it's creating for your infrastructure. The agentic web is arriving. I think it needs a control layer. That's what I'm building with Wayleave. Wayleave.dev

GPTBot is hammering your API. Block it, or charge it?

gibrancorbin11-hub — Thu, 30 Jul 2026 00:49:03 +0000

Check your logs for last month. Filter user-agents for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, bingbot. For most SaaS apps and content APIs in 2026 that's now a real percentage of total requests — traffic you pay to serve, from callers who never convert, never see an ad, never subscribe.

The reflex is robots.txt or a blocklist. Three problems:

Blocking is leaky. Polite bots honor robots.txt; the traffic that costs you most doesn't announce itself.
Blocking is blunt. Some agent traffic is your future distribution — an AI assistant citing your data to a user who becomes a customer.
Blocking earns $0. The traffic has value to the caller. Blocked value is just destroyed, not captured.

There's now a third option, because two standards landed:

Web Bot Auth (RFC 9421 profile): agents cryptographically sign requests; you verify against the operator's published keys. Identity stops being a user-agent string anyone can type.
HTTP 402 + x402: a machine-readable "this costs $0.002, here's how to pay" that agents can settle without a human in the loop.

Which turns your bot problem into a pricing decision per lane:

Verified, signed agents → charge per call on the routes that cost you money. They're businesses; API fees are a line item to them.
Declared-but-unsigned bots → cheap tier or tight rate limits.
Undisclosed automation → paywall or block. Sneaking shouldn't be free.
Humans → free, always. They never see any of this.

Wiring it by hand means reading RFC 9421, fetching and caching key directories, building the signature base, and handling replays. Or:

npm i wayleave

app.use(new Wayleave({
  directories: { 'https://agents.example/keys': { 'k1': pubkey } },
  pricedPaths: { '/api/expensive': 0.002 },
}).express());

One middleware line. Agents get a 402 with a price; your users notice nothing. The interesting question stops being "how do I stop bots" and becomes "what's my agent traffic worth" — and that's a much better problem to have.

What the middleware doesn't do

It prices the request. It doesn't keep your books.

Charging per crossing means knowing what you're owed: a durable record of every billable request, deduplicated, attributed to a cryptographic agent identity rather than an IP guess, and turned into something you can invoice against. The middleware emits a usage event for each priced call and hands it to you. What happens next is your problem — a queue, a table, a reconciliation job.

I'm considering building the other half: a hosted meter that receives those events, keeps the ledger, handles key directory fetching and rotation, and produces billing records per agent operator. Never touching your funds — settlement stays on a payment rail you choose. The meter is the meter, not a middleman.

It isn't built. Not a beta, not a private preview — unbuilt. Whether it gets built depends on whether people running real agent traffic actually want it, so there's a list:

→ wayleave.dev

One email if it becomes real, nothing otherwise. There's one optional question on the form — roughly how much agent traffic you see — and that answer is worth more to me than the signup.

The middleware is free and finished today either way:

npm i wayleave

MIT, zero dependencies, source at github.com/gibrancorbin11-hub/wayleave.

DEV Community: gibrancorbin11-hub

AI agents are changing the way the web is used.

GPTBot is hammering your API. Block it, or charge it?

What the middleware doesn't do