---
title: "Verified Is Not Trusted: A Five-Step Bot Accountability Loop"
description: "A five-step loop for treating bots as accountable actors: verify identity, honor opt-out preferences, measure sustained behavior, band trust, and bound blast radius."
---

# Verified Is Not Trusted: A Five-Step Bot Accountability Loop

**Type:** [How to](https://yomu.fyi/visual-explainers/category/how-to.md)

![Five-step left-to-right flow: verify bot identity, honor robots.txt and opt-out preferences, measure repeated disregard and 429 backoff, adjust a published trust band, and bound blast radius with scoped credentials and audit trails; a dashed arrow loops back to behavior measurement.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/6e306875-e534-47e7-a12e-36447ae5eaa2/image-b52f1271-f53e-4518-af15-310e63f5d3a1.webp)

> A five-step loop for treating bots as accountable actors: verify identity, honor opt-out preferences, measure sustained behavior, band trust, and bound blast radius.

## Explanation

Bot accountability is a loop, not a checkbox: a Verified identity tells you who is calling, but trust has to be earned through sustained behavior. This explainer walks five checkpoints — verify identity, honor stated preferences such as robots.txt directives and opt-outs, measure compliance over time including whether the bot slows down after HTTP 429 responses, convert that record into a trust band with a threshold a site owner can set, and bound the bot's blast radius with scoped credentials, audit trails, and dry runs. The payoff is a reusable mental model for deciding how much access an automated client gets, and when to take it away.

## FAQ

### Why isn't verifying a bot's identity enough to trust it?

Identity verification only establishes who is calling. Cloudflare's accountability system instead measures whether a bot keeps honoring robots.txt directives and slows down after HTTP 429 responses, looking for repeated patterns of disregard rather than isolated violations. A verified bot that ignores site preferences still loses trust.

### How do I turn bot behavior into an access decision?

Behavior is summarized as a trust band that falls when a bot ignores site preferences or fails to slow down after rate-limit responses, and rises with consistent compliance. Cloudflare plans to publish these scores on Radar and let customers choose the trust threshold for Verified bot traffic on their own sites.

### What should I limit before letting an agent act on my behalf?

Scope credentials per agent instead of forwarding a user token downstream, and log the delegation chain so every hop is auditable. Add the operational guardrails the protocol does not supply, such as idempotency, rate limiting, and observability, plus dry-run and fail-secure defaults; Notion's agent tests from a second account that simulates a real user.

**Tags:** [Accountability](https://yomu.fyi/topic/accountability.md), [Bot Management](https://yomu.fyi/topic/bot-management.md), [Bots](https://yomu.fyi/topic/bots.md), [Crawlers](https://yomu.fyi/topic/crawlers.md), [Rate Limiting](https://yomu.fyi/topic/rate-limiting.md), [Trust](https://yomu.fyi/topic/trust.md)

## Related reading

### [How we connected Notion AI to 160 new apps in three weeks](https://yomu.fyi/post/how-we-connected-notion-ai-to-160-new-apps-in-three-weeks.md)
- Company: [Notion](https://yomu.fyi/company/notion.md)
- Author: Eileen Jiang
- Published: Oct 16, 2026
- Type: Problem & solution

Notion used the Model Context Protocol (MCP), an open standard for connecting AI tools to other apps, to expand its AI integrations. Previously, each new MCP connection required hours of manual setup, including creating accounts, navigating developer settings, and testing, so only 25 apps were connected. In three weeks, Notion grew that number to 185 by building a Notion agent that automates the pipeline from setup to production. The agent handles sign-ups, browser clicks, and tests, while humans still review code changes, design assets, and partner with vendors. A key lesson was that private developer apps could pass internal tests but fail for customers, so the agent now tests from a second account simulating real users.


### [Continuous accountability for Verified bots](https://yomu.fyi/post/continuous-accountability-for-verified-bots.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Chris Tsoukaladelis
- Published: Oct 16, 2026
- Type: Announcement

Cloudflare introduces a system to continuously evaluate whether Verified bots honor website preferences, moving beyond identity verification to sustained trust by measuring compliance with robots.txt directives and HTTP 429 rate-limit responses over time. The system looks for repeated patterns of disregard rather than isolated violations, lowering a bot’s trust band if it ignores site preferences or fails to slow down after receiving rate-limit responses, while consistent compliance increases trust. Cloudflare previously de-listed Perplexity’s bot in 2025 for seeking to access opted-out resources and attempting to circumvent controls when blocked, illustrating the need for ongoing accountability. The company plans to share these trust scores publicly on Radar and eventually let customers choose the trust threshold for handling Verified bot traffic on their websites. This forms an accountability loop with Bot Preference Sync and Bot Management, ensuring trust is earned through sustained behavior rather than assumed from identity alone.


### [On-Behalf-Of Is a Pattern. Token Exchange Is the Standard.](https://yomu.fyi/post/on-behalf-of-is-a-pattern-token-exchange-is-the-standard.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Oct 16, 2026
- Type: Explainer

The post distinguishes the On-Behalf-Of pattern from the OAuth 2.0 Token Exchange standard (RFC 8693) and Microsoft’s implementation, warning against forwarding a user’s token downstream as it breaks the audience trust boundary. Token Exchange uses a subject\_token for the user’s identity and an optional actor\_token to record the calling service, with a chainable act claim for multi-hop calls. Microsoft’s implementation uses a jwt-bearer grant, only works for user principals, and can mint SAML assertions for legacy integrations, but the resulting token must never be relayed back to the client. For AI agents, neither OBO nor Token Exchange handles explicit user delegation, so integrators must log act claims, scope tokens to specific tasks, issue per-agent credentials, and build audit trails. The post notes the confused deputy problem resurfaces with agents, and regulatory transparency requirements around automated decision-making are already in effect.


### [MCP standardized tools. Now we need the infrastructure around them.](https://yomu.fyi/post/mcp-standardized-tools-now-we-need-the-infrastructure-around-them.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Vijay Harre
- Published: Oct 15, 2026
- Type: Explainer

MCP standardized how AI models connect to tools, with clients like Claude Code and Cursor adopting it and SDK downloads approaching half a billion monthly. However, production use reveals that the protocol solves only the interface problem, not the operational concerns around authentication, rate limiting, idempotency, and observability. Teams repeatedly build duplicate infrastructure for deployment, secret handling, health checks, and access control because the protocol does not address these. Context efficiency also remains a challenge: a benchmark showed reducing context from 220,393 to 27,352 tokens (87.6%) while maintaining test pass rates, highlighting the need for deliberate context selection. The author argues that MCP’s success forces the question of building a production-grade infrastructure layer, similar to how HTTP led to CDNs and API gateways.


### [How Meta Built Forum With AI-Native Engineering](https://yomu.fyi/post/how-meta-built-forum-with-ai-native-engineering.md)
- Company: [Meta](https://yomu.fyi/company/meta.md)
- Author: Shengbo Guo
- Published: Oct 15, 2026
- Type: Problem & solution

Meta built Forum using AI-native engineering, treating an AI agent as a development participant rather than a faster typing tool. The team shifted from human-in-the-loop to human-on-the-loop, where the agent autonomously plans, implements, builds, tests, and corrects its work while the engineer sets goals and approves outcomes. Success was measured by verified, production-ready results, not code volume, with automated verification signals like build status and unit tests filtering output before review. Meta adapted the codebase for legibility, gave agents tools to inspect live view hierarchy directly instead of descriptions, and created a separate sandbox build to isolate prototype code from production. This approach helped Forum reach core feature parity with Facebook Groups in eight weeks and caught a memory issue during development that roughly halved memory use and page faults.


### [Staying Evergreen: How we automated secure access and repo hygiene in a shared org](https://yomu.fyi/post/staying-evergreen-how-we-automated-secure-access-and-repo-hygiene-in-a.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Greg Mohler
- Published: Oct 15, 2026
- Type: Problem & solution

Managing outside collaborator access and stale repositories in a shared GitHub organization becomes harder to keep up with as projects grow. Evergreen is a GitHub App built with native GitHub features—scheduled actions, webhooks, issues, and custom properties—that automates two workflows: quarterly outside collaborator access reviews and stale repository detection and archival. Its design principles are fail secure, revoking access if no one responds, and never destroy anything, keeping archived repos recoverable and every change tracked in issues. The app is a Go webhook server that stores state as JSON files in a controller repo, using git history as the audit trail, and interacts via checklist issues in each repository. Rollout included dry-run mode, overcommunication, Splunk observability, and proactive rate-limit pacing; the pattern is adaptable using native GitHub features.