PACT and the software-anchor turn — a critical analysis of Private Access Control Tokens

The announcement commits Mozilla, Google, and Microsoft, together with Shopify and Cloudflare itself, to developing and submitting for standardization a protocol that helps humans and bots prove their traffic is not malicious: sites issue anonymous tokens, and other sites accept them without learning who the user is. Its designers describe the goal as privacy-preserving rate limiting. PACT builds on Privacy Pass (RFCs 9576–9578, June 2024), but its candidate designs use anonymous credentials that carry rate-limit state: Anonymous Credit Tokens (ACT) and Anonymous Rate-Limited Credentials (ARC).

Mozilla’s design post names the roles. An Anchor, a site that knows something scarce about the user, such as a subscription, an account in good standing, or a verified phone number, gives the browser a batch of Endorsements. A Moderator, often the site itself, decides which Anchors to trust and exchanges an Endorsement for a Credential, a stateful object that holds the user’s rate-limit balance. On later visits the browser presents the Credential, and the Moderator raises or lowers the balance as the behavior looks benign or abusive. Refusing to return an updated Credential is revocation. In Privacy Pass terms, the Anchor is the issuer of Endorsements, and the Moderator both verifies Endorsements and issues Credentials.

Two properties carry the privacy claim. With issuer blinding, the Moderator learns only that an Endorsement came from one of the Anchors it trusts, not which one. And Credential presentations are unlinkable: the site learns whether the user holds a valid Credential below its rate limit, not the counter’s value and not the user’s earlier visits. Mozilla’s stated target is that no more than that single bit gets through.

PACT is not only about people. The antifraudcg proposal lists unblocking browser AI agents as a use case. Mozilla writes that an agent can carry its user’s Credentials, or that an agent operator can run its own Anchor and vouch for its agents. Cloudflare’s August 2026 post on the agentic internet says PACT “lets sites vouch anonymously, so the agent can present the token elsewhere.” This matters for the farming argument below: if agent operators can act as Anchors, the supply of Endorsements depends on who runs agents, not on how many people there are.

The motivation is real. In June 2026 Cloudflare CEO Matthew Prince reported that automated traffic had passed human traffic: 57.5 percent of HTTP requests for HTML content came from bots, crawlers, and AI agents, against 42.5 percent from people, by a classification he called “a bit messy.” The announcement's stated motivation is that CAPTCHAs and behavioral tracking do not scale to that mix, and the industry is looking for a cryptographic middle ground.

Be precise about the state of the thing. As of October 2026, PACT is at the proposal stage. There is no deployment timeline and no IETF draft published under the PACT name; Mozilla says it will bring draft specifications to the IETF and W3C “as soon as they’re ready.” The cryptographic drafts PACT relies on are unfinished too: the latest ARC and ACT revisions, from March and February 2026, are now listed as expired on the IETF datatracker. What exists is a press statement, a design post, an early design repository, and an open question the announcement does not answer: which Anchors a Moderator should trust, and what check an Anchor performs before it endorses anyone. The next public venue is a W3C TPAC 2026 breakout session, “Bringing Private Access Control Tokens to the Web,” proposed by Dennis Jackson and Samuel Schlesinger.

Apple's Private Access Tokens are the clearest contrast. In the anti-bot deployment, the device attests only that it is a genuine Apple device: Apple acts as the attester and Cloudflare as the issuer, with no installed software. (The checks for OS version, jailbreak status, and login-window focus come from Cloudflare's separate Zero Trust device-posture work, where they were described as planned attributes.) The scarce resource is a device vouched for by its manufacturer. Mozilla's own design post says device attestation requires that “the hardware manufacturer be in overall control of the user’s device,” and calls both Private Access Tokens and Google's earlier proposal “ultimately hostile to users and to the openness of the web.”

PACT is an attempt to widen the trust model so scarcity can come from other anchors: account standing, active subscriptions, verified phone numbers. That is a real difference in attacker economics. Hardware attestation forces a bot operator to acquire or emulate trusted devices. Contextual anchors force the operator to acquire or synthesize credentialed accounts, which can be automated through credential stuffing, bulk registration, stolen sessions, or cheap subscriptions bought in bulk. The Sybil problem does not disappear. It moves from the device to the account.

The history is worth naming. Google's Web Environment Integrity proposal tried hardware-ish client attestation in 2023 and was withdrawn after months of criticism. PACT attests scarcity rather than client integrity, and the cryptography is far better, but the risk has the same shape: a small number of platforms deciding which clients count as legitimate. The question PACT inherits from WEI is a governance one: whether a trust oligopoly is acceptable if the credentials are anonymous.

The proposed design treats the browser as a trusted mediator of credential storage, issuer selection, challenge budgets, and redemption. A bot operator often controls the browser profile, the device, or both. The browser is a convenient API boundary for legitimate users, but it is not a trustworthy admission controller when the user agent itself is automated or compromised.

The cryptographic unlinkability of PACT credentials does not fix this. It ensures a Credential can be presented without revealing which Anchor endorsed it or which user obtained it. Its value still depends entirely on the quality of the Anchor's admission process. Copy a browser profile that holds Endorsements and Credentials, and you hold that user's budget until the Moderator cuts it.

The attack surface is the supply side. If Endorsements can be harvested from compromised devices or bought from negligent Anchors, the system's integrity drops before any site sees a request. Rate limiting is PACT's purpose, but a rate limit is only as strong as the scarcity behind it. The open question is whether the limit holds across Anchors, or whether one person with ten cheap accounts at ten Anchors gets ten budgets. The IETF's 2024 rate-limited issuance draft expired. The work moved to the ARC and ACT drafts, on which PACT's designs depend.

Without a hardware anchor, a bot operator does not need to defeat a secure enclave. They need to emulate whatever contextual signals the Anchor checks. If the Anchor relies on account standing, automate account creation or buy aged accounts. If it relies on subscription status, treat bulk subscriptions as an operating expense. If agent operators can run their own Anchors, an operator vouching for its own agents sets its own supply, limited only by which Moderators trust it. Third-party threat models, such as Krishna Gupta's, list token replay, token theft, Anchor impersonation, Sybil amplification, and metadata leakage. All of them follow from the fact that a software anchor can be duplicated, and none needs more than the ordinary economics of a credential that can be farmed.

The designers accept part of this. In repository issue #11 they write that they “expect malicious bots to obtain PACT tokens,” and that to be useful at scale such bots would need to be well-behaved long enough to accrue access, which the Moderator can then cut. That is a reasonable bet against volumetric abuse. It is weaker against fraud that needs only a few well-aged credentials.

The privacy story is more complicated than the press release suggests. An Anchor knows which of its accounts received Endorsements and when. Unlinkable presentation protects the user at the site, but it does not hide the endorsement event from the Anchor. Hardware attestation, by contrast, pushes that burden onto the device manufacturer, which is a different concentration of trust but not necessarily a bigger one.

The repository contains two serious mitigations. One proposal uses an aggregating issuer, which accepts credential transfers from multiple originating issuers and issues its own tokens, so origins see only the aggregator, and its unlinkability holds regardless of its behavior. Another sketch uses zero-knowledge proofs to hide which issuer produced a credential, removing the intermediary entirely. These are genuine improvements, and Mozilla’s design post adopts issuer blinding for the exchange of Endorsements for Credentials. Neither is yet a requirement of any specification. Until issuer hiding is mandatory, the practical privacy outcome depends on what implementers choose, and in every variant the Anchor keeps its view of who was endorsed.

The centralization risk is hard to see because PACT tokens are initially optional friction-reducers. As adoption spreads, the absence of a token starts to carry information. Origins rationally adjust: token-bearing traffic sails through, untokened traffic gets challenged more aggressively, risk thresholds are recalibrated. No single actor decides to make tokens mandatory. It happens through incremental optimization across thousands of sites, and the risk is that the credential ends up required in practice.

The casualties of that process are the traffic classes that have no issuer relationship: internet measurement systems, security researchers, archival crawlers, RSS readers, Tor users, and alternative browsers. Mozilla’s design says a user with no suitable Endorsements could bootstrap a Credential through today’s mechanisms, such as CAPTCHAs, account creation, or federated login, so the system “degrades to today’s experience.” That holds only while sites keep those paths open. My own inference, not a claim the cited sources make, is that the economics can then invert the stated purpose. Sophisticated bot operators can afford accounts, subscriptions, and vouches. Low-income users, unbanked users, and privacy-conscious people who refuse persistent platform identities could be priced out. A CAPTCHA can be solved without proving consumer status. A subscription-anchored token cannot.

PACT has no accreditation model for Anchors, and that is deliberate. Mozilla writes that Anchors “could be any website which has access to this kind of signal,” that each Moderator chooses which Anchors it trusts, and that “a new Anchor or a new Moderator can be adopted without coordinating with a dominant vendor.” Repository issues #4 and #12, the latter titled “Fragmentation vs. Centralization of Anchors,” debate exactly this trade. The price of that openness is the central security question of the design. A Credential proves that some trusted Anchor endorsed the user. It does not prove that a meaningful check occurred.

Per-Moderator trust invites a classic adverse-selection problem. Low-quality Anchors can hand out cheap Endorsements, and Moderators that want to reduce friction will accept them because they convert more traffic. High-quality Anchors that do expensive vetting are undercut, and the market drifts toward lax endorsement. A malicious or compromised Anchor can endorse bots at scale, and because issuer blinding hides which Anchor backed a Credential, a Moderator cannot tell those Credentials from honest ones without some per-Anchor reputation. Mozilla proposes one: encrypted shares identifying the Anchor, aggregated with multiparty computation, as in Prio, to score each Anchor by the abuse it lets through. Blinding has a second cost, which Mozilla names: the initial balance has to be uniform across a Moderator’s Anchors, “which in practice means setting it at the strength of the weakest.” As of October 2026 the scoring is a sketch, and the public record has no Anchor directory, no process for removing a bad Anchor across Moderators, and no audit requirement.

The result is a trust-proxy protocol. PACT inherits the security posture of whatever Anchors a Moderator trusts, and one origin-facing sketch already concentrates that choice: repository issue #6 has origins configuring up to two aggregating issuers and the credit cost per request. Nothing in the public record indicates a flaw in the anonymous-credential cryptography. The admission process is everything, and it is left to each Anchor.

The governance gap extends to jurisdiction. The materials I reviewed do not address how issuer requirements interact with national firewalls, data localization laws, or state-mandated digital identity. That is a serious omission, because who controls the trust root is a corporate governance question and a sovereign one at the same time.

A government that becomes a mandatory issuer could observe issuance events, deny tokens to disfavored users, and require domestic origins to accept only state-issued credentials. Data localization rules could compel domestic issuance servers. Countries could end up with distinct trust zones where a token issued in one jurisdiction is not accepted in another. That would balkanize the web at the protocol layer, not at the application layer. The announcement proposes no sovereignty model and no mechanism for a user to challenge issuer denial.

The standard critique of proposals like this is to declare them dead on arrival and move on. I think that is the wrong reflex here, for the same reason I take the BotGuard teardown seriously: the mechanism is real and the failure modes are structural. The first marker below pulls against PACT's open-participation goal. Moderators need a way to judge Anchors, and any central body that does the judging becomes the gatekeeper PACT was designed to avoid. With that tension stated, these are the markers that would make this design defensible:

The shift from hardware anchors to software and contextual anchors is not inherently more private, more decentralized, or more open. It relocates trust from device manufacturers to identity providers, payment platforms, and cloud intermediaries. That trade avoids the device-vendor gatekeeping that killed WEI, and it introduces a different set of problems: Sybil resistance becomes account-fraud resistance, Anchors gain metadata visibility, and users without platform relationships risk exclusion.

The least controversial part of PACT is the cryptography. Anonymous credentials give plausible unlinkability at the Moderator, and they build on Privacy Pass, a mature, published architecture, even though the ACT and ARC drafts themselves are unfinished. The protocol’s security ultimately depends on who is allowed to act as an Anchor and how tightly their admission process is controlled. That layer is still a sketch. Until it is specified, PACT is a trust-proxy protocol, and the web has a working precedent for where that ends: a small set of platforms acting as the gatekeepers of legitimacy, with a cryptographically elegant credential standing in for the admission decisions nobody standardized.