As AI agents act for users online, platforms face a new challenge: proving a real, unique human is behind each agent without excessive personal data.