See which agents visit your site, and control what they can do.
Observe mode shows you every request and how much of each visitor’s identity is proven. When you’re ready, one plain-English policy controls access from your own edge account.
01 · Observe mode
free SDK · ten minutes · nothing blockedThe proof ladder — what “identity” means here
The licensing numbers
The log adds up what training crawlers took: how much, how often, and from which parts of the site. When a licensing conversation starts, you walk in with your own numbers. D3 takes no cut of whatever you sign.
Install & what leaves the box
Install is npm middleware or an observe-only Cloudflare Worker template. Verification runs locally in your edge. Only aggregates leave your infrastructure, and you can turn those off too. Full security-review answers are on the Trust & deployment page. If you’d rather see the numbers without installing anything, ask for the concierge report.
02 · The verification engine
Who verifies identity? We do.
The mechanisms
Signed requests
Web Bot Auth (RFC 9421): the agent signs each request and serves its keys at a well-known URL on its own domain. We fetch and validate the directory, so a valid signature is proven identity from the first request, from any IP.
wba-keyPublished infrastructure
For agents that don’t sign, the operator’s own published IP ranges grade the claim. A range file counts only after a person checks it against a written standard — published by the operator, dedicated to the bot, attributable in WHOIS or ASN records. A file that fails the standard gets no pointer, and the bot stays derived.
ua · ua+ipCertificates
Your edge attests the certificate handshake — agent name services and x509 identities — and the result flows into the same engine, where proof from one mechanism can refute a claim made under another.
ans · x509Names come from every major registry, Cloudflare Radar’s directory included. The mechanism set is open: when a new identity standard ships, we add it to the engine. Most bots publish nothing checkable today — the verifiability gap has the numbers.
The evidence lifecycle
Claimed, then proven by us
Every identifier carries a state: claimed by a source, or proven by us. Registries and feeds only ever propose a name — nothing a feed says can mark an identity proven.
Always the latest proof
Evidence is re-fetched from the operator, and freshness is enforced with hard horizons: a delisted key drops immediately, a key never outlives a day without a fresh fetch, and a range file never outlives two weeks. Lapsed evidence leaves the registry, so a stale bot degrades visibly.
Every change on the record
Curation writes an append-only history: who changed what, and when. A mislabeled bot is fixed with one curated edit — tell us and the correction ships with the next registry build.
03 · The policy engine
One policy, written in plain English.
The purpose vocabulary
answering someone's question
an assistant fetching your docs or pricing because its user asked. Block this lane and customers feel it.
user-answersearch indexing
engines that index and cite you. This is your top-of-funnel in AI answers.
searchacting for a person
agents transacting on a user's behalf — the purpose class other standards leave out.
transacttraining data
bulk reads that take your content once and pay nothing. Most sites want this lane priced or refused, and a bot that won’t state its purpose gets treated as a training crawler.
trainingAIPREF has two words for why a bot fetches; Content Signals has three; every registry writes its own. We canonicalize all of it into one vocabulary, and these four are the lanes the policy conversation runs on. Every answer carries its own tier for how proven the purpose is, alongside the identity tier.
Where it runs
In your own edge account
The Worker or middleware installs where your traffic already is, so the policy travels with you instead of being welded to one edge. Prefer to paste rules yourself? There’s a rule-set export.
Additive-only, log-first, fail-open. The full security-review answers are on the Trust & deployment page.
04 · Boundaries
What we don’t do.
Never — by design
Payments
A fetch arriving with payment attached is one more purpose class your policy accounts for. We never settle, meter, or hold money, and we take no cut of deals our numbers help you win.
Bot detection wars
Fingerprinting hostile unsigned traffic is your edge's job, and they're good at it. We classify the provable and hand the rest back.
Sitting in your traffic path
No proxy, no CDN, no traffic through our pipes. You install a feed and a plugin in your own account, and that’s the whole footprint.
See & manage your agentic traffic
Set up D3 Edge on your own traffic — we’ll walk you through it.