WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes compliance mandatory for all government websites.
The current working draft of WCAG 2.2 introduces a new success criterion, 3.3.7: Accessible Authentication. This is a level-A criterion, meaning it must be met in order to claim any degree of compliance.
The success criterion has the following definition:
Success Criterion 3.3.7 Accessible Authentication (Level A): If an authentication process relies on a cognitive function test, at least one other method must also be available that does not rely on a cognitive function test.
The definition of a cognitive function test is given in part as:
A task that requires the user to remember, manipulate, or transcribe information... includ[ing]... memorization, such as remembering a username [or] password[;]... transcription, such as typing in chracters;... performance of calculations; [or] solving of puzzles.
What I'm most concerned about is captcha, which appears to be completely barred by this criterion. The standard "wavy text" captcha is barred as "transcription;" the standard "accessible alternative" audio captcha is also "transcription." The historical alternative "math problem" captcha is "performance of [a] calculation." And the modern captcha is almost blatantly called out by the standard as "solving [a] puzzle" ("identifying which images include a particular object").
How can we verify that an agent accessing a system is indeed a human while still complying with WCAG 2.2 criterion 3.3.7?