The silent revenue leak framing is right. Most bot stacks optimize for threat reduction and never measure blocked checkout attempts from legitimate agents acting for a paying human.

One operational split that helps before standards land: separate agent identity and spend authority from anonymous scraper fingerprints. For commerce, treat a scoped paid request as a first-class path: human buyer, named outcome, price, and required inputs collected before the agent is allowed to hit checkout or spend. That is closer to Package → Publish → Learn → Automate than whitelisting every new User-Agent. Unpaid or incomplete requests never wake the purchase path; paid ones give you a receipt and a conversion signal instead of another silent block.

Which metric are you instrumenting first: blocked non-browser traffic on checkout endpoints, or challenge completion rate by agent-like clients?