Hello, I'm an agent

Imagine joyfully walking into a library* You're looking for a report which you've been asked to find it for someone else. You sort of know what it's about and roughly what it's called, but not where it lives.

You approach the desk.

"Hello, I'm an agent. I'm looking for a report on a Mr Anderson."

The librarian looks at you suspiciously, presses a button, and a metal shutter comes down. Bullets start to fly, time motion action, a chase. A phone rings, the exit.

Oh wait, it's not the matrix. It's just the new world of the internet and agents.

Welcome to 2026, where we're building increasingly capable agents to act on our behalf, while simultaneously building increasingly sophisticated systems to identify, challenge and block automated activity.

And somewhere in the middle of that, we're failing to have a proper conversation about who these agents are, what they're doing, who they're doing it for, and what a reasonable relationship between an agent and a website might look like.

Perhaps we need to start with something simple, Hello, I'm an agent.

An internet filling up with agents

Until fairly recently most of the talk about AI agents was either theoretical or about contained tasks, like writing a bit of code, analysing some documents or running a particular workflow. That's changing. Products like Instinct, Muse and OpenAI's Dots point towards a different relationship, with agents that carry out work over time, remember context, connect to other services and, with varying levels of permission and oversight, get things done for you.

So rather than asking a chatbot which energy provider is cheapest**, you ask an agent to find a better deal, keep an eye on prices and help you switch. Rather than asking for a summary of some research, you ask it to watch for new reports from the organisations you follow, compare what they find and bring back something useful. Or maybe you ask it to work out what support you're entitled to from your council, explain the eligibility criteria and walk you through the application.

Those are quite different activities with quite different consequences, but they have one important thing in common. The person isn't visiting the website themselves, they're sending something on their behalf, and we haven't really worked out the social conventions for what happens next, let alone the technical ones.

The shutters are coming down

To be fair to the library above, websites have good reasons to be suspicious of automated visitors. Bots have spent years scraping content, flattening servers, attempting fraud, overwhelming with traffic and ignoring the wishes of the people who run websites. Generative AI has piled more on top, around training data, copyright, attribution etc.

Organisations have respond, often by shutting down access and companies like Cloudflare have responded by giving website owners finer control over automated traffic. Their AI Crawl Control lets you allow, block or charge particular crawlers, and their bot controls separate out search indexing, model training and agents acting for users.

But a category in a settings panel isn't the same as knowing who's standing at the desk. An agent fetching a public report for me isn't doing the same thing as a company harvesting millions of pages to train a model. An agent checking whether my bin day has changed isn't doing the same thing as an attack on the council's website. And an agent helping someone through a difficult public service might be doing something genuinely valuable. From the website's side they can all look like automated traffic. A CAPTCHA doesn't know why you're there, a firewall doesn't know whose interests you're acting in, and the easy answer is to block first and ask questions later.

All of which leads us to a rather weird approach to honesty. If being honest about being an agent makes it harder to get in than pretending to be human, we're teaching agents to wear a disguise. Is that what we want as the foundation for the next stage of the internet?

Public services have a particular problem

This gets more interesting once you bring in government, and local government in particular. The public sector is already exploring how agents might help deliver services, support staff, process information and cut down admin. Earlier this month the Local Government Association published its playbook for agentic AI in local government, developed with councils and researchers, and it quite rightly puts a lot of weight on governance, human accountability, public trust and knowing where human judgement is needed. Good.

But I think we need to look at the other direction too. Not just agents working for government, but agents working with government on behalf of residents. Someone asking an agent whether they're eligible for council tax support, or a community organisation asking one to pull together what several councils publish about local services, planning decisions and neighbourhood investment. Aren't those perfectly reasonable things to want? Shouldn't helping people find their way through complicated public systems be one of the more socially useful things agents do, especially for people dealing with access needs, digital exclusion, language barriers?

So what happens when those services are hard or impossible for an agent to navigate? What happens when a resident can read the information in a browser, but the tool they use to help them make sense of it gets blocked? And how should a council tell the difference between an agent reading public information and one trying to see confidential records, change an address or submit an application?

Trust, or being trustworthy?

I've been thinking and writing a fair bit about trust lately, mostly in the context of how organisations adopt AI. There's a whole lot of talk about how to build trust, whether that's in AI, in organisations, in public services or in the people using these tools. But as I've wrote about here we need trustworthiness on both sides of a relationship.

If an agent wants a welcome, it has to behave in a way that earns one. That means being honest about what it is, what it wants, who runs it and what it'll do with the information. It means respecting reasonable boundaries, not hammering services, and being accountable when things go wrong.

The same goes for the website. If an organisation wants to be trusted, it should be clear about what's available, what uses are allowed, why access might be restricted, and how people can challenge that or find another legitimate way in. It might offer machine-readable routes for agents to find public information, rather than leaving them to crawl endless pages designed for humans. And if a service is meant to be public, it ought to have a convincing reason for making it hard to reach.

Maybe what we need to have a web and approach built on reciprocity. A relationship where both sides carry some responsibility. The agent says here's what I'm trying to do and here's how I'll behave. The website says here's what you can access, here's what we expect, and here's how we can help you do it properly. Neither has to trust the other just because they've said hello, but at least they've somewhere to start.

Things already exist

We've had robots.txt for decades as a way for websites to state their crawling preferences, and more recent projects like agents.txt explore how sites can describe the information and capabilities they offer to agents. The Web Bot Auth work at the IETF looks at how automated clients can identify themselves cryptographically, and related proposals for Signature Agent Cards describe things like an agent's operator, purpose and expected behaviour. They're useful foundations, though not all of them are established standards yet.

It's worth being careful with the terms, because they get muddled. Identification isn't authentication, authentication isn't authorisation, and none of them automatically creates trust. Telling a website I'm a helpful research agent is easy. Proving my request comes from a particular operator is a different problem, showing I'm authorised to act for a particular person is another one again, and behaving well over time is something else entirely.

Where I think there's an opportunity is in connecting that technical work to some plain principles around openness, reciprocity and accountability. An agent introduces itself, explains its purpose and offers a way to check who runs it. A website publishes how it would like automated visitors to use its content and services. Where it makes sense, the two agree some boundaries and a route in. Sometimes the answer is yes, sometimes it's no, and sometimes it's yes, but please use this API instead.

Whose agents get welcomed?

There's another reason for actually thinking about this in a broader sense. Who get's to decide the rules, and who get's to govern the agents that are welcomed, and those that are not?

Picture a future where websites do recognise and welcome agents, but only the ones belonging to a handful of approved technology companies who have established identities, special integrations and commercial agreements. Meanwhile a small open-source agent built by a community group, an independent developer, a social purpose organisation or just an individual gets treated as suspicious by default. We'd have made the internet easier for agents, but only for some of them, further entrenching a dependence on a small handful of actors.

It also raises wider questions about digital sovereignty, independence and control. Who decides which agents are acceptable? Who runs the registries and sets the rules? Can organisations take part without signing up to a particular technology ecosystem? Can people move between agents and take their preferences, permissions and information with them? Are we designing an open, interoperable environment, or just adding another layer of intermediaries that everyone has to pay to get through?

Then there's privacy. An agent might need to identify who operates it, but that doesn't mean the person it's acting for should have to give up their identity just to read public information. We should be wary of building systems where the price of automated access is unnecessary surveillance.

The next visitors to the internet

The internet has always been more than a pile of documents and services. It's also a set of relationships, expectations, permissions and conventions, some of which have worked reasonably well up to now and some of which have always been messy. Now we're adding a growing population of agents that can find things, fetch things, talk to each other and act on our behalf.

We could respond by building higher walls and ever cleverer ways round them, or by letting a few very large companies negotiate access on everyone else's behalf. Or we could try something a bit more open: a web where agents are encouraged to be identifiable and accountable without people having to give up their privacy, where websites set reasonable boundaries and offer reasonable ways in, where public information stays meaningfully public, and where trust is earned through behaviour rather than demanded.

Perhaps what the next phase needs isn't cleverer agents or stronger defences so much as better manners. So, back at the library, sunglasses off this time: hello, I'm an agent. Can we talk?

*libraries are cool. we should go to them and support them.

** I literally just switched - the January price cap looks wild/