Anyone know how this works under the hood? Hoping it's content negotiation (like Accept) rather than user agent sniffing.

I've been working on AI agent detection in various forms lately (IsAgent, Web Bot Auth), and it feels like we are in a critical period. Can we establish norms that accurate self-identification is good and useful, actually? Or will we slide back into impersonation a la the user agent, like https://webaim.org/blog/user-agent-string-history/ ?