Enterprise Session Attestation // Intent API

Orchestrate the agentic web: permit legitimate AI, isolate user agents, and neutralize threats.

Effective security is no longer about simply blocking all automation. Modern digital businesses must welcome legitimate AI crawlers, cleanly accommodate human-owned developer assistants without polluting device recognition graphs, and decisively eliminate malicious bots, crawler impersonators, and credential stuffers at the edge.

Review Traffic Architecture Explore Live Telemetry Console

Not Just a Bot Blocker: Traffic Orchestration for the Autonomous Era

Treating all non-human actors as malicious attacks breaks modern search indexation and blocks productive developer workflows. ThreatPoint’s Intent Engine is engineered to distinguish intent and provenance: verifying transparent search indexers, isolating human-directed consumer tools (such as terminal assistants and browser automators) so they never pollute device identity graphs, and enforcing immediate automated vetoes against deceptive adversaries.

Zero

Device Graph Contamination

Consumer agents operate statelessly—preventing headless scripts from overriding genuine user device recognition profiles.

100%

Verified Agent Ingestion

Legitimate frontier crawlers (ClaudeBot, GPTBot) flow uninterrupted without triggering deceptive fraud penalties.

<2ms

Edge Governance Latency

Sub-millisecond classification evaluates actor type, network provenance, and route policy before database execution.

Hard

Impersonation Veto

Automated scrapers masquerading as recognized search engines are halted via cryptographic and network provenance mismatches.

Strategic Traffic Enablement

Empowering Transparent AI While Defending the Perimeter

A blunt-force WAF that rejects all non-human traffic blinds your organization to AI search engines, content indexers, and emerging customer-facing shopping agents. ThreatPoint establishes clear traffic governance:

✔ Welcome Transparent Indexers: Permit genuine indexing bots on public content, product catalogs, and documentation with zero fraud score penalty.
✔ Stop Crawler Impersonation: Detect unauthorized datacenter and residential scrapers forging bot user agents, enforcing instant vetoes.
✔ Preserve Frictionless Human Journeys: Real buyers checkout without intrusive CAPTCHA puzzles, while malicious credential stuffers are filtered at the edge.

Device Integrity Assurance

Protecting Device Recognition from Human-Owned Agents

Developers and technical consumers increasingly deploy local CLI runners, personal browser assistants, and workflow automations (e.g., OpenCode, OpenClaude, local MCP agents). Handling them properly is critical:

✔ Identified as User-Delegated: Acknowledge authentic local scripts operating on behalf of real users over residential and corporate IPs.
✔ Device Recognition Gating: Enforce allow_recognition_binding: false so headless environments never bind to or overwrite persistent human device tokens.
✔ Route-Specific Gating: Grant seamless access on search, content, and read APIs, while triggering step-up challenge gates if an agent touches authentication or checkout.

Engineering & Technical Deep Dive

Multi-Layered Forensic Model

Four Corroborated Pillars of Actor Truth & Session Intent

Rather than relying on naive User-Agent strings or brittle cookie flags, ThreatPoint interrogates physical reality across independent network, cryptographic, and runtime boundaries. By decoupling actor identification from risk scoring, the engine cleanly accommodates legitimate agents while neutralizing deceptive automation.

PILLAR 01 // TRANSPORT PROTOCOL

Cryptographic Handshake Telemetry

Examines the incoming TLS 1.3 Client Hello packet at the TCP edge. Analyzes cipher orchestration, extension ordering, and RFC 8701 GREASE injection to determine the true underlying network stack (e.g. Go-http-client, Node Undici, or true Chromium) regardless of declared HTTP headers.

TLS_SIG: t13d1516h2_8daaf6152771
GREASE: VALID (Present on Chromium)
STATUS: Stack matches declared browser

PILLAR 02 // RUNTIME ATTESTATION

Execution Context & Binding Control

Interrogates client JavaScript context integrity. Detects synthetic shims on browser prototypes and verifies genuine hardware ceilings against virtual rasterizers (SwiftShader/llvmpipe). For delegated agents, this layer enforces stateless isolation, disabling persistent device token binding.

ACTOR_TYPE: USER_DELEGATED_AGENT
BINDING_PERMITTED: FALSE (Enclave Isolated)
DEVICE_INTEGRITY: Profile shielded from taint

PILLAR 03 // BEHAVIORAL KINETICS

Micro-Interaction & Muscular Tremor

Samples physical human interaction variance in real time without capturing character data. Evaluates cursor trajectory curvature ratios, acceleration profiles, click dwell intervals, and flight cadence. Robotic stepping and synthetic isTrusted: false dispatches trigger immediate automation classifications.

CURVATURE: Organic parabolic arc (>1.05)
CADENCE: Biological typing variance (>15ms)
KINETICS: Verified physical human input

PILLAR 04 // NETWORK PROVENANCE

Network Intelligence & Provenance

Cross-references inbound IPs against ThreatPoint's threat database, ASN registrations, and reverse DNS records. Confirms whether traffic claiming to be ClaudeBot or GPTBot genuinely originates from authorized cloud ranges, flagging unverified residential or budget hosting egress as spoofed impersonation.

PROVENANCE: Anthropic AWS verified range
ASN_MATCH: Confirmed provider infrastructure
RISK_PENALTY: 0 (Authentic Transparent Agent)

Comprehensive Policy & Device Binding Matrix

How ThreatPoint translates session classification, route sensitivity, and intent forensics into real-time actions and binding controls.

Entity Classification	Observed Characteristics	Attestation Verdict	Enforced Action	Device Recognition Binding
Standard Human Session	Valid TLS GREASE, organic kinetic micro-tremor, residential/enterprise ISP	`HUMAN`	ALLOW	BINDING ALLOWED
Verified AI Agent	Declared crawler identity verified against published provider ASNs/rDNS	`AUTOMATED_AGENT`	ALLOW	STATELESS (NO BIND)
Human-Owned Consumer Agent	Local developer tool (e.g. OpenCode, OpenClaude) on general/read routes	`DELEGATED_AGENT`	ALLOW	ISOLATED (NO BIND)
Consumer Agent on Sensitive Path	User agent attempting interactive authentication or payment endpoints	`DELEGATED_AGENT`	CHALLENGE	ISOLATED (NO BIND)
Crawler Impersonation	Claims to be official AI crawler from unauthorized budget VPS or residential IP	`AUTOMATED`	DENY	VETOED & BLOCKED
Deceptive Headless Scraper	Dispatched synthetic events, virtual GPU renderer, machine-uniform kinetics	`AUTOMATED`	DENY	VETOED & BLOCKED

ThreatPoint Cyber Security