Cloudflare proposes trusted agent delegation so sites can see the users behind AI agents

Cloudflare says that hosted personal agents, which take instructions from a user and control a cloud computer or browser, act as intermediaries that hide the user from the site. The post lists challenges this creates, including account sharing, friendly fraud, identity verification that breaks when an agent passes it through, risk-based authentication that flags cloud infrastructure, and uncompensated content extraction. In nearly all of these, the site bears the main cost.

Cloudflare's proposed direction combines existing and emerging standards. It points to Web Bot Auth for signing agent requests to identify the agent and its operator, MOLE for rate limiting without user-specific identifiers, and x402 for privacy-preserving payments. It describes graduated identity levels from nothing to session, account and unique IDs. The company is also announcing the Trusted Agent Delegation coalition to bring ecosystem participants together and take well-defined problems to the IETF.

Cloudflare says customers can now see which agents visit their site through Security Analytics, set access per agent with AI Crawler and Agent access policies, and, for sites using Account Abuse Protection in early access, see which personal agent made a login or sign-up request. A WAF rule on a Hashed User ID can mitigate one abusive account without blocking the agent for other users.

Agent developers may find more sites asking which user an agent acts for, so passing session or account identifiers and signing requests with Web Bot Auth may matter for access.

Sites may block or restrict agents per policy rather than by a shared user agent, so agents that hide their identity or share one client across many users risk being blocked for everyone behind them.

Agents that pass CAPTCHAs or KYC checks through to a human may be limited by the verification step itself, as the post says those checks cannot confirm who the agent acts for.