Is "is this a bot?" still a useful question?

A growing share of automated traffic is somebody's assistant doing exactly what they asked it to do.

Which makes "block bots" a strange policy. If a customer tells their agent to book the thing, compare the plans, fill in the form — and you refuse it — you have refused a customer who is standing right there. They do not see a bot challenge. They see a product that does not work.

But the opposite is obviously wrong too. An autonomous crawler hitting your signup endpoint on nobody's behalf is not a customer and never was.

Both are "a bot". Both may be running the same framework, from the same cloud, with the same fingerprint. Nothing in the request separates them, because the difference is not technical — it is about who asked.

The distinction that turns out to matter is whether a human initiated this specific request. The emerging identity standards actually carry this: an operator declares whether an agent is a fetcher (a person asked) or a crawler (nobody did). It is the only signal I have seen that maps onto the decision you actually want to make.

So: are you still blocking on automation, or have you moved to something else? And if you have moved, what did you move to — I have not seen much consensus.