Three different actors, three different failure modes
A human operating a browser, a fixed script performing a defined task, and an autonomous agent making its own sequence of decisions toward a goal each fail differently when something goes wrong. A human notices when something looks off and can stop. A script does exactly what it was written to do, for better or worse, and nothing more. An agent can chain many small, individually reasonable actions into a consequential outcome nobody explicitly authorized, especially if it's reacting to untrusted input along the way.
Treating all three identically — the same rate limits, the same scope of standing access, the same lack of a stop mechanism — ignores that their risk profiles genuinely differ, not just their traffic patterns.
Detection is a signal, not a guarantee
Distinguishing between these categories from request patterns alone is inherently probabilistic — nothing about an HTTP request definitively proves who or what originated it. Detection narrows the uncertainty; it shouldn't be the sole basis for a consequential access decision. Pairing detection with actual constraints — tighter scope and additional gates specifically for automated and agentic traffic, regardless of how confidently it was classified — is what actually bounds the risk.