As AI agents started browsing the web like people, a question got practical fast: should a bot hammering your API pay like a customer? The answer running across these sites is a uniform tollbooth — any declared AI agent pays five dollars in digital currency for a twenty-four-hour pass, per site, while humans in browsers never see a thing. One flat rule an agent learns once beats per-call metering, which would punish legitimate heavy users a thousand times harder.
The machinery is deliberately unfancy. Detection is a declared user-agent plus a machine content format — and the design openly admits a spoofer can walk past it, answering with rate limits instead of an arms race. Payment follows the same 402 pattern as the music memorial; the transfer is verified on-chain; the pass is a one-day token, and an expired one gets a different error than a missing payment, because precise errors are a feature. The rollout order tells you the ethos: the read-only world-ratings API first, lowest blast radius, proven with a real five-dollar payment before anything else. Even the deployment footguns — preview branches, date mismatches, zombie background processes — are written into the plan so the next session doesn't trip.
Students: learn to write the error cases before the happy path — the difference between 402, 400, 401, and 409 is the whole craft. Hiring managers: honor-system detection, fail-closed verification, one database line that stops double-spending, and holes documented instead of hidden — that is senior systems judgment, in public.
No comments yet