Intent and identity: Redesigning access for a world of AI agents

At the AWS Summit in Stockholm, Queue-it's CPTO, Hans Skovgaard, joined Jasmine Chua, Senior Account Manager at AWS Copenhagen, on the AWS – Smart Business podcast to discuss one of the most significant shifts facing digital businesses today: the rise of the agentic web. AI agents acting on behalf of consumers are beginning to arrive at scale. They can search, compare, purchase, and complete transactions faster than humans, fundamentally changing how demand is created and managed online.

The challenge is no longer “How do we stop bots?” It’s “How do we manage them?"

Here are the highlights from that conversation.

For years, organizations have focused on managing access to high-demand online experiences while balancing fairness, security, and performance. Bots have always been part of that equation, with some creating value and others creating risk.

Now, consumer-facing AI agents are introducing a new category: automated participants acting on behalf of real people. Whether helping users find products, secure tickets, or complete transactions, these agents blur the traditional line between human and machine traffic.

As Hans put it, "After identifying the visitor, human versus agent, the intent behind that agent matters the most."

This shift changes the conversation. Rather than focusing solely on who is accessing a system, organizations must increasingly consider why they're accessing it and whether that intent aligns with the rules of fair access.

Agentic AI isn’t just another wave of digital transformation. It’s a step-change in how traffic behaves.

AI-powered shopping agents are always on, operating at machine speed, and capable of acting at scale. The result? More pressure on peak events than ever before.

This matters most in high-demand scenarios, exactly where Queue-it operates:

• Product drops
• Ticket sales
• Travel bookings (from global pilgrimages to seasonal tourism)
• Government services and university enrollments

And as Jasmine highlighted, some estimates state agentic commerce could drive up to $5 trillion in retail value by 2030. The upside is huge, but so is the strain on infrastructure. 

This isn’t just about handling more traffic. It’s about handling fundamentally different traffic.
 

If bots can represent legitimate intent, then what defines “good”? According to Hans, a “good” shopper, human or agent, is one that:

• Has legitimate intent
• Behaves transparently
• Can be trusted within the system

This matters because the line between human and bot is already blurring. Bots can mimic human behavior—slowing down interactions, limiting clicks, and blending in. Identity alone is no longer a reliable signal.

As a result, fairness needs to evolve. It becomes something that is:

• Behavioral
• Contextual
• Continuously evaluated  

Defining “good” is one thing. Enforcing it at scale, in real time is another.

This is where infrastructure becomes critical.

In this new reality, the waiting room takes on a much bigger role, Hans explained.

Historically, virtual waiting rooms have been about managing access. Controlling traffic flow to prevent crashes and ensure fairness. That remains true but now, they also serve as a decision layer.

And the waiting room also creates something incredibly valuable: time.

Time to validate intent, assess trustworthiness, and prevent downstream bottlenecks, like overloaded systems or overwhelmed support teams.

But there’s a catch.

Waiting rooms weren't initially built for agents; they were built for humans. So today, when some agents encounter a waiting room, they might stall. Unable to interpret what's happening or how to proceed at the same pace as a human would.

To solve this, Queue-it is actively developing systems using an MCP server that allow agents to enter queues like any other participant, be processed according to defined rules, and then be routed or validated dynamically.

But validation at scale requires more than time. It requires a standardized way to signal trust.

And that’s where things begin to shift from control to coordination.

If identity is no longer enough, what replaces it? "The answer is trust", said Hans.
 
Through its partnership with AWS, Queue-it is helping pioneer a new protocol with the TSAI (Trust and Security AI) protocol. This early-stage protocol is setting up the groundwork for the concept of trust certificates for agents. 

Here’s how it works:

• Agents identify themselves using a credential issued by a trusted third party (e.g. Trusted Shops)
• Queue-it (or a Service provider) validates that certificate upon entry
• The Service provider reports back to the Trusted Authority the successful outcome of the agent to create a positive or negative feedback loop  
• This creates a more flexible and scalable model where different events can require different levels of trust, and the sensitivity levels can be tuned based on risk and demand by the customer.  

In this system, access is based on verified trust, not on speed or identity alone. But what about privacy?

Any system built around identity raises immediate privacy concerns. But the TSAI protocol offers a different approach.

Instead of tying access to a specific individual, trust is verified at the agent level—without exposing personal data, explained Hans.

That means there's no need to share user identity to gain access and there's no direct link between the agent and the individual behind it.

It’s a protocol that preserves both fairness and security for businesses and privacy for consumers. 

Agents aren't going anywhere. But neither are humans, Hans stated. The future is hybrid.

For years to come, businesses will need to design systems that support human visitors and agentic shoppers.

This creates new challenges, like different speeds of interaction, different patterns of behavior, and different expectations around access.

It also elevates fairness from a backend function to a core product capability. And as infrastructure evolves, so does experience.

Hans used Queue-it's Visitor Engagement feature as an example of this shift.

Traditionally, waiting rooms have been seen as a necessary friction point. But they also represent something powerful: undivided attention. Visitor Engagement transforms this moment into an opportunity. Why? Because buyers are already there and fully focused.

Bath & Body Works, a Queue-it customer, implemented an interactive quiz using the feature during a product drop and received 1.5M responses at a 61% completion rate.  

"Visitor Engagement was a great brand touchpoint that allowed us to promote products, build excitement, and keep people in the waiting room—a win for the customers & the business.”

Chris Fry, Product Manager, Bath & Body Works

This opens new possibilities like turning queues into conversion channels, personalizing experiences with AI, and bridging the gap between IT and marketing departments.

And the inspiration behind the feature isn’t new. Think about it: At Disney World, waiting in line for an attraction is part of the overall experience. Or retail environments where, while waiting in line, the buyer can browse additional products before reaching the register.

"It's all about bringing that physical queuing experience online", explained Jasmine. "Digital queues are evolving from infrastructure into experience layers".

Today, there's no established standard for how AI agents should interact with high-demand digital experiences. That presents both challenges and opportunities.

Organizations are already asking how they should prepare for agentic traffic. The answer goes beyond technology. It requires new ways of thinking about access, trust, and fairness online.

Businesses will need to define what legitimate agent activity looks like, develop flexible trust frameworks, and build systems that can respond as expectations and behaviors evolve. The shift underway is larger than a change in traffic patterns. It's changing how access to digital experiences is granted, managed, and protected.

And as a result, the role of the gatekeeper is changing as well.

For the past 15 years, Queue-it has helped organizations protect their most critical online moments by keeping unwanted bots out. The next chapter is about helping them distinguish between harmful automation and trusted agents, while ensuring fair access for everyone.

The future of access management will focus on orchestration as much as protection. Success will depend on understanding who, or what, is seeking access, why they're doing so, and how that access should be managed.

The web of the future will include AI agents as active participants. The organizations that thrive will be those that can build trust, apply clear access policies, and create experiences that work for both humans and machines.