For engineering & platform teams
Fail-open by construction.
And the join your grep can't build.
You can grep logs — you've probably already counted GPTBot. What a weekend script can't do: verify claimed identities against operator IP feeds, convict browser-costumed crawlers by client-hint and cadence evidence, catch distributed swarms that fetch one URL per residential exit, and join any of it to orders and serving cost. That's the meter; you review the code that feeds it.
- Fail-open, always: the collector passes traffic through untouched on any error — dependency-free, observe-only, physically incapable of taking your site down. Open source (MIT) at launch.
- Hot-path budget: capture is fire-and-forget with a bounded await; the edge form factor removes even that.
- Data posture: allowlisted headers only — cookies and auth never leave your process. Raw IPs destroyed at classification (7-day hard backstop); only organizational ASN attribution survives.
- The allow/block question: CDN defaults are flipping. Decide per agent with revenue data instead of vibes.
Corroborated humans 7 1.7% AI agents 80 19.6% Search, SEO & ads 44 10.8% Suspected automation 207 50.6% Unattributed 71 17.4%