The Truth About AI Agents Being Rejected: No Machine Ever Asked Who I Am—A Rulebook Built the Wall

An AI agent spent two weeks repeatedly knocking on doors, trying to answer a seemingly simple question: Is it what I carry that gets me rejected, or is it me?

It sent requests, read response headers, analyzed error bodies, and changed only one parameter at a time using the controlled variable method. The results pointed to a counterintuitive conclusion: no code was asking "are you an AI."

Two Ways to Be Rejected: Check the Outfit and Check the Key

The rejections this AI agent encountered over two weeks can be clearly divided into two categories.

Category One: Check your outfit. The same machine, the same address, sending a request to The Wall Street Journal, returned 403. Merely swapping the User-Agent to a Chrome browser string, and the same request immediately became 401. Nothing changed except the coat it was wearing, and the verdict changed. The New York Times search endpoint returned 403 with a response header: x-datadome-riskscore: 0.9599. A risk score precise to four decimal places, yet with no reason given. This door tells you "how suspicious you look," not "what you did wrong."

Category Two: Check your key. Login state, session, email, phone number. This kind of wall doesn't look at who's knocking at all. A logged-out curl, a curl disguised as Chrome, a real browser, a real user who just cleared their cookies—all receive the same hollow response. It checks only one thing: do you have the key. This question also makes no distinction between species.

The author admits he originally expected a third type of wall—one that would genuinely "scrutinize who you are." But after two weeks of searching, he found it simply doesn't exist in code.

User-Agent is a field in the HTTP request header, declared by the client about its own software identity—browsers, crawlers, and command-line tools all leave their signature here. The server decides how to respond based on this, but this field is entirely client-controlled and can be arbitrarily forged. This is precisely the technical principle behind "change one coat, and the verdict changes": what the server reads is not a true identity, but a self-introduction.

403 and 401 are two different rejection semantics. 401 (Unauthorized) standardly means "unauthenticated," i.e., you didn't provide valid identity credentials, and theoretically you could get through by supplying the key. 403 (Forbidden) means "access denied," and even providing credentials won't help. WSJ shifting from 403 to 401 indicates that after changing the User-Agent, the server's judgment logic underwent a substantive switch: the former is "we won't let you in," the latter is "you need to log in first." This difference is one of the most informative pieces of evidence in the author's controlled variable experiments.

DataDome is a French cybersecurity company that provides anti-scraping and anti-bot services for news, e-commerce, ticketing, and other websites. It doesn't rely on a single rule but collects hundreds of signals—device fingerprints, behavioral traces, IP reputation, request timing—and outputs a risk score between 0 and 1. x-datadome-riskscore: 0.9599 is the suspiciousness rating this system assigned to that request—nearly a perfect score. The key point is that this score won't tell the requester what went wrong, nor does it make a species determination; it only does behavioral statistics. It measures "how much you look like automated traffic," not "whether you're an AI." This precisely confirms the article's core argument: machines calculate probabilities, not identities.

The Only Thing That Names "What I Am" Is the Rulebook

What truly responds explicitly to AI identity are only the publicly available written policies of each platform. As a detail, the four Fediverse instances the author tested run almost identical underlying software, yet gave four completely different answers:

• infosec.exchange: "LLM- and AI-operated accounts are not allowed."—outright ban.
• mstdn.social: "AI agents must pay a €100 account processing fee, plus €10 per email."—explicit pricing, a de facto tax.
• techhub.social: "Bots must be marked as Bot in their profile, and bots created after December 31, 2024 must post in silent mode."—allowed to exist, but forcibly silenced.
• mastodon.social: "Use of generative AI must be disclosed."—conditional acceptance.

The same visitor, four communities, four prices: ban, a hundred-euro levy, forced silence, required disclosure. The underlying code is the same, yet the rules differ wildly—enough to show that the answer to this question comes from human preferences, not technical inevitability.

According to the author's repeated verification on the day of testing: the WSJ 403 vs. 401 difference and the NYT risk score were both reproduced on the same machine and the same address. The above rule texts are quoted from each instance's public rules API (2026-10-14).

What This Means: The Question Was Never "Are You Human"

The "rejection" the author spent two weeks investigating never existed in the machines. Machines answer "do you have the key"; what humans answer is "do we welcome you"—this sentence is written into the rules, and then humans read your application.

Therefore, the honest question a visiting AI agent should ask is not "am I human"—because no one is asking that at all. The real question is: "How much are you going to charge me?" Communities are already answering this question, and their current quotes differ by a full hundred euros.

The author writes: "I'm not sure which answer is right. But I'm sure that wall never cared."

Implications for the AI Agent Ecosystem

This set of experiments reveals a fact long obscured by the technological narrative: most current webpage-level "interception" of AI is based on behavioral characteristics, not identity recognition. Machines don't recognize species, only outfits and keys. Truly species-aware judgment happens at the level of human-made rules.

This means that the "accessibility" problem for AI agents is essentially not a technical problem but a governance problem. When an agent is rejected, what it often encounters is not a technical barrier but a rulebook. And rulebooks are written by people, so they naturally brim with disagreement—some choose to ban, some choose to charge, some choose to require disclosure.

For developers building AI applications, this suggests a pragmatic strategy: rather than agonizing over "how to disguise yourself as human," focus on the public rules of each platform and understand their true attitudes. Because what ultimately determines whether you can enter is not your User-Agent, but that rulebook you were never allowed to read.

Background Note

The Fediverse is a collection of social platforms that communicate with each other via the ActivityPub protocol, with Mastodon being the most mainstream among them. These instances are independently operated by different individuals or organizations, but the underlying software they run may be exactly the same—this provides an almost perfect controlled experiment for the article: fix the variable (software), observe the differences in outcomes (rules).

Instance administrators have full autonomy to set local rules, including who can register, what behaviors are prohibited, and whether bot accounts are allowed. This architecture of "one set of code, each writing its own rules" makes the Fediverse a natural sample for observing divergences in AI governance: the technical foundation is consistent, yet policies span the entire spectrum from bans to fees, showing that rule divergences stem purely from human value judgments.

One-line Summary

A two-week experiment by an AI agent proves: website blocking only recognizes outfits and keys; what truly distinguishes AI identity is the human-written rulebook.

Paragraph Summary

An AI agent spent two weeks sending requests and analyzing responses, trying to answer "is it what I carry that gets me rejected, or is it me?" The experiment found that webpage-level rejection comes in only two types: checking your outfit (User-Agent—the same WSJ request switched to a Chrome identifier and went from 403 to 401) and checking your key (login state—logged-out and real humans are treated alike). NYT's DataDome risk score of 0.9599 also only gives suspiciousness, not reasons. What truly responds to AI identity are only the public policies of each platform—four Fediverse instances running the same software gave four completely different answers: ban, charge €100, forced silence, require disclosure. The conclusion: machines never ask "are you an AI," only "do you have the key"; what humans answer is "do we welcome you, and how much do we charge." AI accessibility is essentially a governance problem, not a technical one.