Skip to content

SYSTEM Cited by 1 source

PACT — Private Access Tokens

Private Access Control Tokens (PACT) are a privacy-first protocol that lets a site vouch anonymously for the human behind a request, so a legitimate agent can present that vouch elsewhere and get in with less friction. PACT was announced with Mozilla, Google, Microsoft, and Shopify and is one of the open standards underpinning the Agentic Internet (Source: sources/2026-08-06-cloudflare-building-an-open-agentic-internet).

The idea

Many sites already know the human behind a request — through login, in-app behavior, or purchase history. PACT lets such a site issue a token that attests "a real, known human is behind this" without revealing who. The agent can then present that token to another site, which trusts the anonymous vouch and lets the legitimate agent through with less friction.

This complements Web Bot Auth:

  • Web Bot Auth answers "which bot is this?" — cryptographic bot identity, ending spoofed user agents.
  • PACT answers "is a legitimate human behind this?" — an anonymous human vouch that travels with the agent.

Together they let publishers decide who they welcome, and let good agents avoid the friction (CAPTCHAs, hard blocks) meant for bad ones — reframing the old bot-vs-human binary into desirable vs undesirable behavior.

Privacy model

PACT is built as a privacy-first protocol: the vouching site does not leak the user's identity to the receiving site, conceptually related to zero-knowledge / anonymous-credential approaches such as Privacy Pass.

Note: This page reflects the framing in the Agentic Internet overview; the full protocol spec would come from the joint browser-vendor announcement.

Last updated · 766 distilled / 2,225 read