Comment by owebmaster

> The agent should be treated as an untrusted user in your client,

An untrusted user in a client is a hacker/invasor, not an agent.