The agent web stack explained
The agent web stack is the set of tools a company needs to serve AI agents the way the human web stack serves people. Every layer of the human stack has a counterpart: where humans have a CDN, agents need a bot CDN. Where marketers have Google Analytics, AI visitors need server-side analytics. Where shoppers have a checkout, agents need machine payments.
The human web stack was assembled over 25 years, one layer at a time, each layer answering a question about a human visitor. The agent web stack answers the same questions about a visitor that has no screen, runs no JavaScript and pays in tokens.
The map
| Question | Human web | Agent web |
|---|---|---|
| What are people looking for? | Keyword tools (Semrush, Ahrefs, Google Trends) | Brand intelligence: what agents actually read, across 10,000+ sites |
| How do we serve the page? | CDN, DXP, CMS | Agent site: bot CDN for delivery, Agent Site CMS for content |
| How do we know who came? | Google Analytics, tag managers | Server-side AI analytics: agent, page, success, referral |
| How do we reach people where they already are? | Search ads, display ads | Agent advertising: brand facts and offers in the agent-served version of publisher pages |
| How do we take money? | Checkout, payment gateway | Machine payments: HTTP 402 and per-fetch or per-action pricing |
| Who may come in? | WAF, bot management | The same WAF and bot manager, plus terms per agent |
Each row is a separate decision, exactly as it was on the human web. The rest of this page takes them in the order a company usually meets them.
Delivery: CDN and CMS become the agent site
The human stack separates delivery (CDN) from content (CMS). The agent stack does the same. A bot CDN is the origin for identified AI agents on your domain, reached through a subdomain and a routing rule, and it returns a rendering built for machines. The Agent Site CMS is how your team decides what that rendering says, page by page, without touching the human page or filing an engineering ticket.
This is the layer to build first, because every other layer assumes agents can read you. If a retrieval bot gets a JavaScript shell with forty words of text, measurement tells you about an empty room.
Measurement: Google Analytics becomes server logs
Google Analytics counts visitors by running a script in the browser. AI agents do not run scripts, so GA4 reports zero AI reads on a page that was fetched ten thousand times. The only record of AI reading is the server log, or the CDN or bot CDN in front of the server.
A server-side AI analytics view answers different questions. Which agent fetched which page. Whether the fetch succeeded or was blocked. Which pages agents request that do not exist. And how many humans later arrived from an AI answer, which is the one part of the loop GA can see, as a referral from chatgpt.com or perplexity.ai. On tollbit.com the ratio of AI reads to AI referrals over the past month was roughly 1,000 to 1.
Demand: keyword research becomes reads
Keyword tools estimate what people type into a search box. The agent equivalent is observing what agents fetch, because an agent's fetches are a direct trace of the questions it is answering. Across 10,000+ sites, that trace shows which topics are being read, on which third-party pages, by which agents, and how your share of those reads compares with other brands in the category. Share of reads is to the agent web what share of search is to the human one, with the difference that reads are observed rather than estimated.
Reach: search ads become agent advertising
On the human web, if your own page does not rank, you buy a place on the results page. On the agent web, the equivalent is placing brand facts, information boxes, FAQs or promo codes into the agent-served version of a publisher's page, with the publisher's approval and clear labelling, so the agent reading that page sees the facts. Humans see no change. Pickup is measured in net-new reads and per-agent promo-code redemptions.
Payment: checkout becomes HTTP 402
Humans pay at a checkout. Agents pay over HTTP. Status code 402, Payment Required, has been reserved since the 1990s and is now used to quote a price to a bot before content or an action is served. On the publisher side this is the bot paywall: 2.6B+ AI bots were directed to the TollBit Bot Paywall in the first half of 2026. On the commerce side it is the groundwork for personal assistants that hold a user's payment credentials and complete purchases.
Access: bot management stays, and gains terms
The one layer that does not need replacing is the WAF or bot manager. Akamai, Cloudflare, DataDome, Imperva and HUMAN already identify AI agents. What changes is where you send them: to the agent site rather than a block page or the human origin, with terms per agent.
Where TollBit fits
TollBit builds the agent side of this map as one stack: the bot CDN and Agent Site CMS, server-side analytics from the same logs, TollBit Intelligence across the network, the bot paywall and 402 rail, and agent advertising on publisher pages. Each layer works alone. They work better from the same logs.
Frequently asked questions
Do I need every layer on day one? No. Most companies start with the agent site and the analytics that come with it, because the first question is whether agents can read you at all. Demand, advertising and payments follow.
Does the agent web stack replace my existing stack? No. It runs beside it. Your CDN, CMS, analytics and WAF serve humans unchanged. The agent stack serves the visitor class they were not built for.
Who owns this inside a company? Delivery and access usually sit with digital, IT or security, because they touch DNS and the WAF. Content and demand sit with marketing or commerce, because they decide what agents should read.