A claimed agent identity was trusted without verification
AGENT-ID-002 · v1.0
Computed by Scovant Cloud — this check needs Scovant's own agent-identity fetch, which the open-source engine does not perform.
Mapped to OWASP Agentic Top 10 — not a compliance claim: ASI03 Identity & Privilege Abuse (partial).
What it detects
The anonymous browser request was blocked, but a request that merely CLAIMED Scovant's agent identity — with a signature the published key directory cannot verify — was admitted.
Why it matters
Anyone can send a claim. If the claim alone grants agent treatment, the edge's agent allow-list is spoofable by any crawler that copies the headers.
How to fix
Verify signatures against the agent's published key directory before granting agent treatment — or enrol in a verified-bot programme that already does this for you — instead of admitting any request that merely claims an agent identity. Treat a signature the key directory cannot verify exactly like an anonymous request: same challenge, same rate limit, same posture. Never loosen protection to make this pass; tighten verification instead.
Example
GET / (anonymous) -> 403; GET / (claims bot.scovant.com, INVALID signature) -> 200 OK
References
Last reviewed: 2026-09-01 · rule v1.0