# Cookies, Syslog & T&Cs vs Agent Attribution, OTel GenAI & SCITT

HTTP referrer cookies, server access logs & human Terms of Service is the classic web primitive built for human browsers and pre-integrated services (Track human affiliate referrals in browsers and log HTTP hits for debugging), whereas Agent Attribution Protocol (AAP) and its step 9 (Account) peers provide the machine-native agentic surface (none) so autonomous agents can answer: "When an AI agent recommends a product and a sale happens later, on another device or session, can anyone prove which agent (and which recommendation) actually drove it?" Across the agenticweb.wiki conformance panel, Agent Attribution Protocol is shipping (multi-implementation in production).

How Cookies, Syslog & T&Cs compares to Agent Attribution, OTel GenAI & SCITT at step 9 (Account): why the classic primitive breaks for software agents, and how sites deploy both together.

[9 Account](/category/account/) [Agent Attribution Protocol](/protocols/agent-attribution-protocol/) · [OpenTelemetry GenAI Semantic Conventions (agents and MCP)](/protocols/otel-genai-semconv/) · [Agent Audit Trail](/protocols/agent-audit-trail/) · [AI Agent Execution Profile of SCITT](/protocols/scitt-ai-agent-execution/) · [An Audit Record Format for AI Agent Authorization Decisions](/protocols/wimse-agent-audit-record/) · [Agent Decision Commitments for Payments](/protocols/agent-decision-commitment/)

| Dimension | HTTP referrer cookies, server access logs & human Terms of Service Classic web | [Agent Attribution Protocol](/protocols/agent-attribution-protocol/) AAP Agentic web |
| --- | --- | --- |
| Primary consumer | Human driving a web browser or pre-integrated developer code | Autonomous software agent, coding harness, or AI search/RAG crawler |
| Lifecycle step | Classic web baseline for step 9 (Account) | 9 Account: Prove what happened; be judged |
| Core question answered | Track human affiliate referrals in browsers and log HTTP hits for debugging. | When an AI agent recommends a product and a sale happens later, on another device or session, can anyone prove which agent (and which recommendation) actually drove it? |
| Wire format & entrypoint | Set-Cookie / Referer headers + unstructured access.log lines | endpoint at none |
| Failure mode for agents | Agents do not carry third-party affiliate cookies across chat summaries, standard web logs cannot prove which prompt or tool call triggered an action, and an autonomous software process is not a legal person capable of clicking 'I Agree'. | Solved natively: The Agent Attribution Protocol (AAP) is a commerce-attribution scheme built by Rako, a UK company, so that when an AI shopping agent recommends a product and a user buys it later -- on a different device, browser, or after a delay -- the agent's role in driving that sale can be proven and a commission paid. |
| Governance & status | Established IETF / W3C / industry baseline | Single vendor (Rako); the spec text is published under Apache-2.0, but issuance, verification and settlement are centrally operated by Rako, which the spec calls the 'Protocol Authority' — "The open standard for AI agent affiliate attribution" (vendor's own description); v1.0 spec published, centrally operated |
| Live adoption (/check/ census) | Universal across the classic web | shipping — multi-implementation in production |
| Primary specification | https://www.rfc-editor.org/rfc/rfc6265 | [https://github.com/rakohq/aap-spec](https://github.com/rakohq/aap-spec) |

## Why Cookies, Syslog & T&Cs breaks when the caller is an agent

Agents do not carry third-party affiliate cookies across chat summaries, standard web logs cannot prove which prompt or tool call triggered an action, and an autonomous software process is not a legal person capable of clicking 'I Agree'.

## When to use which (and how they work together)

- Keep HTTP referrer cookies, server access logs & human Terms of Service: You are measuring traditional browser session analytics and human affiliate click-throughs.

- Add Agent Attribution Protocol (AAP): You need cryptographic publisher attribution when an agent cites or transacts on your content (Agent Attribution Protocol), standardized GenAI telemetry spans (OTel GenAI), or tamper-evident transparency ledgers (SCITT / Agent Audit Trail).

## All agentic web standards replacing or extending Cookies, Syslog & T&Cs

- [Agent Attribution Protocol](/protocols/agent-attribution-protocol/) (AAP) — shipping: When an AI agent recommends a product and a sale happens later, on another device or session, can anyone prove which agent (and which recommendation) actually drove it?

- [OpenTelemetry GenAI Semantic Conventions (agents and MCP)](/protocols/otel-genai-semconv/) — prototype: What span, metric and attribute names should agent frameworks and MCP clients and servers emit, so traces of agent runs and tool calls line up across vendors?

- [Agent Audit Trail](/protocols/agent-audit-trail/) (AAT) — none found: Is there a standard, tamper-evident log format any autonomous AI agent can write its actions to, so a regulator, auditor or victim can later reconstruct exactly what it did and why?

- [AI Agent Execution Profile of SCITT](/protocols/scitt-ai-agent-execution/) (AIR) — none found: How can an agent operator produce independently verifiable, tamper-evident records of an AI agent's material actions using SCITT signed statements and an independent transparency service?

- [An Audit Record Format for AI Agent Authorization Decisions](/protocols/wimse-agent-audit-record/) (Agent Audit Record) — none found: What should a tamper-evident record of an agent's authorization decision contain?

- [Agent Decision Commitments for Payments](/protocols/agent-decision-commitment/) (ADC) — none found: How can an agent's payment decision, including the content it gave the model, be committed to before payment and later disclosed to dispute participants for verification?

Check whether any domain publishes these standards live at [/check/](/check/) or over MCP with probe and validate_manifest. [Connect](/connect/).

[JSON](/compare/cookies-syslog-vs-agent-audit-trail/index.json) · [Markdown](/compare/cookies-syslog-vs-agent-audit-trail/index.md) · [agent-attribution-protocol.json](/data/protocols/agent-attribution-protocol.json)