A driver's license proves identity and that a test was passed, not that the holder will drive responsibly. Cloudflare applies the same logic to bots: Web Bot Auth lets a bot cryptographically sign its requests, and BotBase catalogues that identity in an open format. But identification alone answers only "Are you who you say you are?" — not "Can we trust you?" A known bot can still ignore site preferences, overwhelm origins, or evade controls, often through nothing worse than a misconfiguration or bug. Cloudflare's new system evaluates and reports when Verified bot behavior drifts from its declared purpose, keeping the trust answer at "Yes."
The concrete pieces of this accountability model:
- Three criteria define a Verified Bot: identify yourself accurately and securely, do only what you say you will do, and avoid abusive behavior.
- Web Bot Auth provides signed requests that establish identity; BotBase catalogues those signatures in an open format.
- The new evaluation and reporting system watches behavior after verification, flagging deviations from the second rule — the "do no harm" requirement.
- Cloudflare frames this around a distinction between risk and intent, acknowledging that many deviations stem from misconfiguration or bugs rather than malice.
For developers, the implication is that bot verification is becoming a continuous signal rather than a one-time credential. Passing identity checks no longer guarantees continued trusted status; operators of legitimate bots need to ensure signed requests stay within declared scope, because origin owners will gain visibility into when that scope slips. If you maintain crawlers, integrations, or automated clients that rely on Web Bot Auth signatures, expect behavioral accountability to matter as much as correct identity headers — and plan for monitoring that catches drift before it costs you trusted status.
Source: https://blog.cloudflare.com/verified-bots-accountability/