I need to detect when my web app is being triggered by an AI agent so I can feed a fraud‑detection system and label agents as good or bad.
I will prioritize header analysis because it is low‑cost, immediate, and many AI SDKs expose identifiable headers.
I will implement rate‑pattern thresholds as secondary filters to catch agents that mask their headers.
I will maintain a whitelist of known good API keys, IP ranges, and OAuth client IDs to avoid false positives.
I will train an XGBoost classifier on combined header, rate, payload, and TLS features to handle edge cases where deterministic rules fail.