> a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. > to authorize access to a specific set of internal clients, A

> a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. > to authorize access to a specific set of internal clients, Are you, the person, authorized to access the site? If yes, setting a User Agent header to "My-Obscure-User-Agent" is truthful (insofar as it bears on whether you (the person) are authorized), regardless of whether you are using the prescribed internal client. If you are not authorized, the use of said internal client doesn't change that. Edit: as a analogy, suppose you took a job and your employer provided you with a uncomfortable uniform jacket which your employment contract stipulated you must wear when on the job. If you acquired a more comfortable jacket and dyed it to resemble the uniform, your employer would (arguably) be within their rights to refuse you access (blocking by user-agent), but if they let you in, that does not mean you have entered (the employee-only portions of) your workplace without authorization. Same applies to cars, phones, power tools, etc; you may have done something wrong by bringing them to work, but that something is not unauthorized entry.