# How to tell agent traffic from user traffic

DevFeed: [How to tell agent traffic from user traffic](<https://devfeed.tech/articles/how-to-tell-agent-traffic-from-user-traffic-31434.md>)

Original publisher: [Read original article](<https://workos.com/blog/identifying-agent-traffic>)

Author: WorkOS

Published: 2026-09-16T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [audit trail](<https://devfeed.tech/topics/audit-trail.md>), [audit](<https://devfeed.tech/topics/audit.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [audit](<https://devfeed.tech/tags/audit.md>), [audit-trail](<https://devfeed.tech/tags/audit-trail.md>), [auth](<https://devfeed.tech/tags/auth.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [logs](<https://devfeed.tech/tags/logs.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This tutorial explains how to distinguish agent traffic from user traffic in access and audit logs. It describes identifying agent tokens with a claim, separating the acting agent from the delegating user, and recording both identities so automated changes can be queried accurately.

## Source excerpt

Your access logs probably say a person did something an agent did. Four claims fix that, and one of them exists for exactly this purpose.