If you’re deciding whether to trust Web Bot Auth signatures on your store, here’s the current answer: as of September 1, 2026, the core spec is an official IETF working group document — the first Web Bot Auth draft to carry that status — but it is still several stages away from becoming a ratified standard.

What actually changed

On 2026-09-01, the IETF’s webbotauth working group adopted draft-meunier-webbotauth-httpsig-protocol-02 as its own item, republishing it as draft-ietf-webbotauth-httpsig-protocol-00 — the commit message in the spec’s own repository reads, verbatim, “protocol draft has been adopted by the wg.” That’s the document defining HTTP Message Signatures (RFC 9421) for bot traffic: the Signature-Agent header for key discovery and the JWKS-based key directory served at a well-known URI — the exact mechanism AgentReady’s own crawler already signs every probe with.

The IETF Datatracker’s own record confirms the same date and adds the formal status: document type “Active Internet-Draft (webbotauth WG),” WG state “WG Document,” authored by Thibault Meunier (Cloudflare) and Sandor Major (Google), and it explicitly “Replaces draft-meunier-webbotauth-httpsig-protocol” — the individual submission it grew out of.

Why “WG Document” is not “standard”

Don’t read WG adoption as ratification. The datatracker lists this draft’s IESG state as “I-D Exists” — the earliest point on the IETF’s own track, before WG Last Call, before IESG evaluation, before an RFC number is assigned. What adoption actually means is narrower but still real: the working group has taken editorial ownership of the text, instead of it being one engineer’s individual proposal competing with others for attention.

The working group’s charter (approved 2025-10-23, chaired under responsible AD Mike Bishop) explains why this document specifically: its scope names “AI agents retrieving or interacting with content on behalf of end users” as in-scope, alongside search crawlers and archivers, while explicitly ruling “tracking or assigning reputation to particular bots” out of scope. The charter also commits the group to a separate best-current-practice or informational document on operational considerations — key management, deployment, impact on the openness of the web — which has not been adopted yet; only the core signing protocol has reached WG-document status so far.

What this does — and doesn’t — change for merchants

Nothing in your CDN or WAF configuration needs to change today. Verifiers like Cloudflare, AWS WAF and Akamai were already checking signatures against pre-standard drafts months before this adoption, and that hasn’t stopped. What adoption buys is a credibility line: “the spec our verifier checks against now has an IETF-owned home, not just a set of competing individual drafts from one vendor.”

It does not resolve the interoperability gap this research covered in August — the disagreement between the newest draft’s mandatory dictionary-form Signature-Agent header and Cloudflare’s live verifier, which still requires the older bare-string form. Adoption changes who owns the document’s future edits; it says nothing about which wire format ships in the next revision. If you’re troubleshooting a rejected signature, match what your verifier actually accepts, not the newest text in the repository.

FAQ

Is Web Bot Auth an official internet standard yet?

No. As of September 2026 it is an IETF working group document (draft-ietf-webbotauth-httpsig-protocol-00), and the IETF Datatracker lists its IESG state as “I-D Exists” — the earliest formal stage, well before RFC publication. Treat any claim that it is a “ratified standard” as premature.

What happened on September 1, 2026?

The webbotauth working group formally adopted the individual draft draft-meunier-webbotauth-httpsig-protocol-02 as its own document, republishing it as draft-ietf-webbotauth-httpsig-protocol-00. The change is recorded both in the spec’s GitHub repository and on the IETF Datatracker, which now lists the document as “Replaces draft-meunier-webbotauth-httpsig-protocol.”

Do I need to change my signing or verification setup because of this?

No. Working-group adoption changes who edits the document going forward; it does not by itself change the wire format. The Signature-Agent header format dispute between the current draft and Cloudflare’s production verifier, covered separately, is still unresolved and is the thing to actually check your integration against.

Sources

AgentReady’s audit signs every probe with this same mechanism, so the document’s standards-track status is one we track directly rather than take on faith.