Fastly and Experian: verify AI agents at the edge

Experian announced on July 24 that Fastly has joined its Agent Trust ecosystem, and the plain-English version matters more than the press release framing: the plan is to verify AI agents at the network edge — identity, delegated authority, intent, and payment credentials — before a request ever reaches your application. A credit bureau and a CDN teaming up on agent identity tells you exactly where agentic commerce is heading. Not toward blocking bots. Toward pricing and permissioning them.

What actually happened

Per Experian's release, the pairing puts Experian's Human to Agent Binding — which ties a verified consumer, device, and agent together into one accountable relationship — behind Fastly's programmable edge. Fastly then applies identity-based access policies, pricing, rate limiting, and transaction approval at the edge, and integrates with Know Your Agent providers to validate identity and payment credentials in milliseconds. The selling point is that it hooks into your existing APIs, auth, and payment flows rather than requiring an application rebuild.

The release leans on three third-party numbers, and they're worth separating. Imperva's measurement that 53% of all web traffic is automated is the one that's actually counted. Salesforce's claim that AI agents influenced $262 billion in 2025 holiday sales is an attribution model. McKinsey's projection of up to $1 trillion in U.S. agentic commerce by 2030 is a forecast. One data point and two directional bets — useful context, not a business case.

Why AI agent verification matters for your business

If you sell online, half your traffic is already software, and your stack currently can't tell an agent shopping on a customer's behalf from a scraper rebuilding your price list. Cloudflare already shipped a way to charge agents at the edge. Now the identity layer wants to be a bureau lookup. Both are real. Neither is something a small storefront should be buying this quarter.

Do the free version first:

1. Measure your own split. Bucket a month of access logs into humans, verifiable agents (declared user-agent plus signature or published IP range), and unidentified automation. You cannot write a policy about traffic you've never counted.
2. Decide per path, not per site. Product, availability, and price endpoints can stay open to agents — that's distribution. Cart, checkout, account, and anything that writes go behind real auth and per-identity rate limits.
3. Put the rule at the edge, not in the app. Cloudflare Workers, Fastly Compute, or your reverse proxy. When the policy changes — and it will change every quarter for the next two years — you edit a rule instead of shipping a release.

Get that structure in place and whenever a bureau-backed verification standard actually wins, adopting it is adding one check to an edge rule you already own. Skip it, and you'll be rebuilding checkout under someone else's timeline.

Sources: Experian, Practical Ecommerce.