Most bot defense on business software assumes a clean line: humans use the UI, machines use the API. You rate-limit the API, you fingerprint the browser, and you sleep fine. That model dies the moment agents start doing their work through the same interface a human does. Not calling endpoints. Clicking buttons.

Non-API automation running inside the UI is sandpaper. Any single pass looks harmless. But it runs constantly, and every heuristic you deploy to catch it becomes a surface it grinds against. Mouse-movement checks, timing thresholds, session shapes: each one is a grain of grit removed, because the automation adapts to whatever the last defense measured. Over enough passes the defense is not defeated. It is worn smooth.

Why the UI is the hard case

• The API has a schema, so abuse has a signature you can name.
• The UI is where legitimate humans are indistinguishable by design, so an agent that mimics them inherits their cover.
• Blocking the UI too aggressively means blocking your actual customers, which is the one thing product will never let you do.

That last constraint is the whole game. You can be ruthless with the API because no paying human touches it directly. You cannot be ruthless with the UI, because that is where the revenue lives. So the agent picks the channel where your tolerance is highest and your visibility is lowest, and it operates there. The friction it creates is not dramatic. It is continuous. And continuous friction is what grinds a defense down.

The honest response is to stop asking "is this a bot" and start asking "is this work authorized." Identity, intent, and accountability survive the collapse of the user-versus-bot line. Motion analysis does not. When the sandpaper is fine enough, the only thing you can still measure is who told it to run.