Verification as a Service: stop trying to detect bots, and start vouching for humans instead.

A concept I worked out on my own time, written up here as a thought exercise. It has not been built, piloted, or proposed to anyone, and it is not connected to any employer's product or roadmap. Every number below is invented for illustration. I am publishing it because the reasoning is the part worth showing.

Automated traffic is now a majority of activity on much of the web. The industry's response has been two decades of increasingly aggressive detection: puzzles, challenge screens, behavioral scoring, interstitials. That approach has a structural problem. Detection is a probabilistic guess that gets harder every year, while the cost of generating convincing synthetic traffic keeps falling.

The people who pay for this are the real ones. A human trying to buy a concert ticket loses to software that checks out in milliseconds. A human reading an article clicks fire hydrants first. A human writing a thoughtful comment gets buried under generated noise. The web has quietly started penalizing people for being biological.

Meanwhile the cost lands on businesses too: serving pages to bots that will never convert, and pricing invalid traffic into every advertising campaign as a permanent loss.

Detection asks an unanswerable question: is this traffic fake? Verification asks an answerable one: can this session prove it belongs to a person?

That inversion only works for a platform that already holds three pieces at once: an identity system people are signed into, a browser that can carry a signal without the user doing anything, and a consumer product people already pay for. Any one of those alone is not enough. Together they can issue something like a verified-human credential and carry it silently across the web.

I called the user-facing piece a humanity flag. The mental model is TSA PreCheck for the internet: you are not proving who you are at every door, you are proving once that you are a person, and then skipping the line everywhere.

The interesting property is that this is a two-sided market where each side makes the other more valuable. Consumers create the verified population; businesses pay for access to it; the payment funds the consumer benefit.

An idea like this fails immediately if it becomes a tracking system, and it deserves to. A credential that says "this is a person" must not also say which person, or the platform issuing it has built cross-site identity surveillance and called it a safety feature.

So the only version worth building is one where verification happens on the device, the proof is zero-knowledge, and the site learns exactly one bit: verified human, yes or no. No identifier, no shared ledger, nothing that lets two sites compare notes about the same visitor.

That constraint is not a compliance checkbox bolted on afterward. It is the thing that decides whether the concept is legitimate or corrosive, and it is why I would not want to see a version of this shipped by anyone who treated it as optional.

The reason I find this concept interesting is that it has two independent revenue streams that do not cannibalize each other. Here is the shape of the model, with round invented inputs.

Most product ideas die because nobody connects the user problem to a reason a business would fund fixing it. I wrote this one out end to end, from the friction a person feels at a checkout page through to where the money would come from and what would make it unacceptable to build, because that is the version of an idea that is actually worth arguing about.

I am not claiming this is novel or that it should be built. I am showing how I think when I am handed a problem and asked what the opportunity is.