Origin

Because “how did this arrive” is currently not a question a lead list can answer. You can filter by campaign, by page, by form and by date. You cannot filter by whether a person was involved, and in a web where most requests are automated that is the filter that decides what the rest of the list means.

The third value is deliberately Unverified rather than Bot. We do not know it was a bot. We know we did not establish it was a person, which is a different and smaller claim — and stating the smaller claim is the whole difference between a tool you can trust and a dashboard that flatters you.

Origin is derived, not declared. One form definition publishes two surfaces — the human interface and a Manifest an agent can call — so which surface a submission came through is a fact about the request rather than an inference about the submitter. Everything that arrives by neither identified path is Unverified.

Origin describes. It does not block. Nothing on a submission that arrives after the fact can prevent that submission, which is true of every classifier and not a limitation specific to ours.

If your problem is volume hitting the door, the tools for it are in the anti-spam set and the honest recommendation there is Turnstile and OTP verification, neither of which is us. Origin is for the question that comes after: of the submissions you accepted, which ones involved a person.

The second error is reading Unverified as an accusation. Some of it is your most privacy-conscious customer. Route it, do not delete it.