ShellFrame AI vision · The agentic web
The internet is gaining a second population.
People will still browse, compare, decide, and create. But they will increasingly send software agents to search, evaluate tools, discover services, and complete routine work for them. The web needs an active trust layer for that future—one that can understand who is acting, for whom, with what authority, and under which rules.
The shift
The web was built for people clicking through pages.
Its basic contract is familiar. A search engine discovers a page. A person follows a link. A website shows information, asks for input, and records an action. Identity and intent are often inferred from a login, a browser session, or the fact that a human is present to press the final button.
Agents change that contract. An agent can read hundreds of pages, compare services, call tools, fill forms, and coordinate with other agents before a person sees a result. It can be useful without looking human—and it should not need to pretend to be human. The missing question is no longer only, “Is this a bot?” It is, “Is this agent allowed to do this specific thing for this specific person?”
Pages waited for people.
Search engines indexed content, sent visitors back, and websites converted attention into an action.
Agents read and act.
AI systems browse, summarize, compare, call tools, and complete tasks across several services.
Trust has to become explicit.
Services need identity, delegated authority, policy, consent, and evidence around every sensitive action.
Current state
This transition is already underway.
AI traffic is not one thing. Some bots train models. Some refresh search indexes. Some retrieve information for a live user. A smaller but growing class can take action. Treating all of them as either trusted humans or hostile automation loses the context that an internet service needs to make a good decision.
The economics are changing too. Cloudflare reported that training represented nearly 80% of observed AI crawling in July 2025, while user-directed actions were just over 3%. Its data also showed that some AI platforms crawled hundreds or thousands of pages for each visitor they referred back. The old exchange—let crawlers read, receive human traffic in return—is becoming less predictable.
Crawling no longer guarantees a click.
Website owners need more control over whether machine access is allowed, denied, limited, or part of a direct relationship—not only a binary crawler rule.
Cloudflare crawl-to-click data →Agents are connecting to real systems.
The Model Context Protocol gives AI applications a standard way to reach data, tools, and workflows. That makes agents more useful, and turns permission into infrastructure rather than prompt text.
Model Context Protocol overview →Agents are learning to find other agents.
Agent2Agent patterns use machine-readable cards and well-known URLs to advertise capabilities and coordinate tasks. Discovery is moving from pages alone to services that can explain what they do.
Google's protocol guide →The missing infrastructure
The internet needs more than bot detection.
Detection is passive: classify traffic after it arrives. The agentic web needs an active exchange. An agent should be able to identify itself, state whose request it carries, discover the service's rules, ask for the minimum authority it needs, and leave a decision trail that both sides can understand.
- 01DiscoverWhat can this service do?
- 02IdentifyWhich agent is asking?
- 03DeclareFor whom and why?
- 04AuthorizeWhat may it use?
- 05ActWithin a narrow boundary.
- 06ProveWhat decision was made?
Design principles
Five properties of a web that can trust agents.
No single protocol or product will own this transition. But useful systems will need the same foundational properties, whether the agent is searching for information, evaluating a tool, contacting a company, or performing an approved action.
Machine-readable discovery
Services should explain their capabilities, limits, and contact paths in a form agents can reliably parse.
Verifiable identity
A service should be able to distinguish a named, accountable agent from anonymous automation.
Delegated authority
An agent acting for a user should carry narrow permission, not silently inherit the user's full power.
Active, owner-defined policy
The service owner should be able to allow, deny, limit, price, or escalate a request based on context.
Evidence after the action
People need a useful record of who requested what, which rule ran, and what the service decided.
Our direction
ShellFrame AI is working toward an active trust layer.
We believe the answer is not to block every bot, trust every agent, or force autonomous software to imitate a person. The better path is an active system that lets agents and services establish enough trust for one specific interaction—then enforce the boundary and preserve the result.
Our current work starts where the problem is concrete: AI coding agents, sensitive tools, credentials, policy decisions, approvals, and audit. That work gives us a real enforcement boundary to learn from. We are also exploring how the same principles extend to discovery and interaction across the wider internet.
This is a statement of direction, not a product roadmap. We are sharing the problem, the principles, and the future we want to help build—not the implementation details of what comes next.
A simple future interaction
“Find the right service and handle the routine parts for me.”
A user's agent discovers several services and reads their declared capabilities. It presents its identity and the user's intent. A service exposes safe information immediately, asks for explicit approval before a sensitive step, and grants only the authority needed for the task.
The person remains in control without manually operating every page. The service remains in control without treating every agent as an attacker. Both sides receive a clear record of what happened. That is the kind of internet ShellFrame AI wants to make possible.
Build trust into the path
More agents should create more useful work—not more invisible authority.
Start with the security boundary we are building today, or tell us where autonomous agents are already meeting your services, data, and production systems.