A verified bot is an AI crawler whose identity has been confirmed by evidence outside its own user-agent header, most commonly a reverse-DNS lookup that resolves the requesting IP to the operator's published address ranges, or an emerging cryptographic scheme that signs the request. It is the answer to a simple problem: a user-agent string is self-declared and trivially spoofed, so the name in a request tells you what a bot claims to be, not what it is.
Verification matters because AI-crawler controls that trust the header, including robots.txt, are only as reliable as the honesty of the bot. Non-compliant scrapers routinely rotate IPs, fake browser identities, and impersonate well-known bots, so any real enforcement or measurement has to key off verified identity rather than the label. Blocking, rate-limiting, and allowlisting all depend on knowing the traffic is genuinely from the operator it names.
In practice, verification takes three forms: reverse-DNS and published-IP-range checks (the long-standing method operators like OpenAI, Anthropic, and Google document); managed "verified bot" lists at CDN level (Cloudflare and others maintain them); and signed-agent standards such as HTTP Message Signatures / web-bot-auth, still early but designed to make a bot's identity cryptographically provable. Verify before you act, because trusting the header alone lets an impostor through and blames the wrong operator for traffic that was never theirs.