[kijin]

I think you still care too much about the visitor's identity and agency.

Step back a bit and ask why anyone ever tried to throttle or block bots in the first place. Most of the time, it's because they waste the service operator's resources.

From a service operator's point of view, there is no need to distinguish an AI agent that rapidly requests 1000 pages to find the best deal from a dumb bot that scrapes the same 1000 pages for any other purpose. Even a human with fast fingers can open hundreds of tabs in a minute, with the same impact on your AWS bill. You have every right to kick them all out if they strain your resources and you don't want their business. Whether they carry a token of trust is as irrelevant as whether they are human. The problem has always been about behavior, not agency.