Personal AI agents create an identity and accountability problem for websites. An agent may look like a human visitor or like one visitor acting for many users, leaving a site unable to determine who is behind a request, whether that party is trustworthy, or who is responsible when an action causes harm.
The company argues that broader agent access depends on preserving the relationship between sites and users through identity, reputation, and accountability. It is focusing on remotely hosted agents operated as managed services, while noting that on-device and locally hosted agents present different concerns because they lack a single operator with whom sites can build reputation or assign responsibility.
Cloudflare announced the Trusted Agent Delegation coalition to bring together agent operators, identity providers, payment companies, merchants, publishers, proxy providers, and cloud-browser companies. The group plans to examine existing protocols, refine concrete problems, and contribute work to standards efforts including the IETF. Cloudflare also cited Web Bot Auth, AIPREFs, OAuth, WIMSE, and MOLE as relevant activities.
Cloudflare customers already have several controls. Security Analytics can identify personal assistants and show their traffic patterns. Access policies can allow or restrict individual agents. Account Abuse Protection, currently in early access, can link logins and sign-ups to an agent and a hashed user identity, allowing a site to respond to abuse on one account without blocking every user of a shared agent.