For website owners and developers

This is olli's agent.

olli is a personal assistant that works for one person, who talks to it from their iPhone. When that person asks it to check a menu, find a time or fill in a booking request, it can open your website in its own browser, the way they would. This page tells you how to recognise it, what it does, and how to turn it away.

What it is

olli works for one person at a time, only on what they ask for, and it asks before anything that matters: sending, booking, buying or deleting waits for their OK in the app. It is software that browses for a person, not a crawler. It doesn't build a copy of your site, and it doesn't read your pages to train an AI model.

To understand a page and carry out the request, olli reads the page with an AI model (Claude, from Anthropic). That is the only use of what it reads.

How to recognise it

olli doesn't hide, but its user-agent alone won't tell you it's olli: its browser is Chromium under automation, which keeps the standard automation signals (such as navigator.webdriver) and sends a normal Chrome user-agent string. What does tell you is a cryptographic signature on its requests, using the HTTP Message Signatures standard (RFC 9421) in the form used by Web Bot Auth.

Header: Signature-Agent: "https://agent.hiolli.com"
Signature: Signature-Input and Signature: Ed25519, tag="web-bot-auth", covering "@authority" and "signature-agent", valid for 60 seconds, with a fresh random nonce each time.
Public keys: https://agent.hiolli.com/.well-known/http-message-signatures-directory, the key directory (itself signed).
Agent card: https://agent.hiolli.com/agent: name, purpose, contact and expected request rate, as JSON.

To check a request: take the key id from Signature-Input, find that key in the directory above, rebuild the signature base from the covered components (your own host name is the @authority), and verify the Ed25519 signature. Reject it if created and expires don't cover the present moment, or if you have seen the nonce before. The signature says "this is olli". It says nothing about the person using it: no name, email address or account number is in it.

Which requests are signed

Only over HTTPS, never plain HTTP.
Page loads, and the XHR and fetch calls a page makes to its own site (the same registered domain).
Each redirect step is signed again, for the host it goes to, with a new nonce. A page load redirected to another site is signed for that site, since it is now the page olli is on; a background request redirected to another company's site arrives there unsigned.
Not images, scripts, fonts, stylesheets or video; not requests to other companies' sites (analytics, ad networks, CDNs, robot-check widgets); not WebSockets.
Signing can be switched off, and a request also goes out unsigned when the browser can't sign it (the first load of a pop-up window a page opens, for example). An unsigned request is not proof it isn't olli.

How often

A task is a handful of page loads plus whatever each page loads by itself. The rate we expect, also in the agent card, is an average of 1 request per second and no more than 5 per second. It's an expectation rather than a hard cap in olli's browser, so a busy page can briefly go above it; if you see much more than that, please write to us.

What it won't do

Solve, bypass or work around a CAPTCHA or a robot check. If it meets one, it asks the person to take over in the app.
Hide that it is automated, or pretend to be a particular person's own browser.
Place an order, send a message or book anything the person hasn't approved.
Sell what it reads on your site, train a model on it, or share it with anyone beyond the AI model that reads the page for the person.

Allow it or block it

It's your site, so it's your call. To allow olli, do nothing. To refuse it, match the Signature-Agent request header in your web server, CDN or firewall and answer 403. For example:

# nginx
if ($http_signature_agent ~* "agent\.hiolli\.com") { return 403; }

# Apache (mod_rewrite)
RewriteCond %{HTTP:Signature-Agent} agent\.hiolli\.com [NC]
RewriteRule ^ - [F]

Sites behind a CDN or bot-management service can do the same with a custom rule on the Signature-Agent header. You can also give olli an allowance of its own (a higher rate limit, say) by matching the same header, but only trust it after checking the signature as described above, because anyone can send a header.

Blocking the header turns away the requests olli signs (see above), which include its page loads while signing is on. olli doesn't yet keep a list of sites to stay away from, so a rule like the ones above is the dependable way to refuse it. You're still welcome to write to us.

Contact

security@hiolli.com, for anything about olli's behaviour on your site: a problem, a question or a complaint. We read every message. How olli treats personal information is on the privacy page.