As I replied to @xpilar, the questions you mentioned need to be discussed and the conditions defined accordingly.
Implementation in the code is then the easiest part...

I don't think it's possible to automatically detect future bots. However, the list could be updated with a transparent code change.