Cloudflare adds analytics and per-agent access policies for personal agents

Personal agents act as intermediaries between people and websites, and to a site owner their requests look like automated traffic. Cloudflare says its new analytics bring agent identity into traffic details, using its verified bot directory. The Bot Analysis chart in Security Analytics now includes a Personal Assistants category, and a Personal Assistants widget in Top statistics lists each agent with its request count. Filtering on one agent updates the other widgets to show its paths, status codes and networks.

For sites that use Account Abuse Protection, which is in early access, fraud teams can see which user each agent represents. Login and sign-up events show whether a personal agent made the request, and account overviews list the agents acting for each account. A WAF rule on a Hashed User ID can mitigate a single account without blocking the agent for other users.

On the policy side, Cloudflare has expanded the existing Agents policy in Security Settings to cover supported personal agents. Each agent can be set to Allow (do not block), Block on pages with ads, or Block. The setting is now named AI Crawler and Agent access policies, and existing Search and Training policies are unchanged. Cloudflare also says it plans further work on carrying user context, reputation and accountability for agents.

Agent developers using supported personal agents on sites that run on Cloudflare may see them labeled and may face different access rules per site, depending on each owner's settings. Agents that log in or make purchases should expect that a site can now trace a request to a specific account and restrict that agent for that account alone.

Site owners can still block agents broadly, but per-agent policies mean an agent may be allowed on some sites and blocked on others. Check how your agent is classified and what errors it receives on protected pages.