Browser agent detection now needs three layers: behavioral risk signals, signed identity, and explicit authorization for high-risk actions.