The Pulse
Cloudflare Announces Trusted Agent Delegation Coalition on AI Agent Traffic
Cloudflare announced the Trusted Agent Delegation coalition to bring representatives from across the ecosystem together for discussions about AI agent traffic. Its post describes how remotely hosted agents can obscure the people behind requ
AI.info Team · Written with AI · fact-checked ·
Cloudflare announces the Trusted Agent Delegation coalition
On November 5, 2026, Cloudflare announced the Trusted Agent Delegation (TAD) coalition. The post describes its goal as bringing representatives from across the ecosystem together for discussions. Cloudflare says the work includes connecting running implementations with emerging specifications and collaborating on open protocols.
The post states the Intermediation Principle: the business relationship between users and sites, and each participant’s security responsibilities, must be upheld regardless of intermediation. It then says sites need tools to recognize, serve and hold accountable users acting through agents, as well as the agents and their operators. Cloudflare says that, traditionally, security and fraud prevention require identity, reputation and accountability, which let sites assess who is acting, whether they can be trusted and who answers for an action.
Hosted agents can hide the people behind requests
Cloudflare defines “Personal AI Agents” as automations that take instructions from a human and pursue a goal by controlling a cloud computer or browser. An operator usually hosts and maintains these agents as part of a managed service or consumer offering. The post names Muse from Meta and dots from OpenAI as examples.
A remotely hosted agent is an intermediary because it sits between a user and a website, which sees the intermediary instead of the person. Cloudflare says an agent may resemble a human browsing the web or appear as one visitor acting for many users. When a shared agent causes trouble, a site may see the agent but lack information to distinguish the people it serves.
The post uses an example of an assistant who runs errands for several clients to show how the problem affects shops and websites. A store that sees only the assistant may struggle to establish whether a client authorized a disputed purchase. A bank might detect password attempts but, if it can block only the shared intermediary, also cut off that intermediary’s legitimate users.
Cloudflare lists risks to sites and says common proposals fall short
Cloudflare lists risks including account sharing, compliance failures, friendly fraud, identity spoofing and resource exhaustion. It says agents poll constantly, hit expensive endpoints such as search or support chat, and use up free trials and promotions. Sites that serve content may also pay to provide it to an agent without receiving a visit, advertisement impression or purchase.
A common proposal is for agents to pass a site’s CAPTCHA through to the user to solve. Cloudflare says this proves some human is present at that moment (“human in the loop,” or HITL), and nothing more. It says HITL cannot tell Bob from anyone else and says nothing about who the agent acts for the rest of the time. Narrow access permissions have a limit of their own: the post says that even a narrow scope only says what the agent was allowed to do, not who answers when it gets something wrong.
Cloudflare’s post focuses on agents hosted away from a user’s device. It says local agents, such as OpenClaw, and agents running in a user’s own browser are out of scope of the post’s primary topic. The post says agents that are not run as an intermediary raise different concerns because they look like automation and have no single party to build reputation or hold accountability with.
Cloudflare describes an identity spectrum
For agent identity, Cloudflare names Web Bot Auth (WBA) as its preferred method. WBA lets an agent sign its requests, giving a site a way to identify the agent and, implicitly, its operator. The post says a mechanism that supports multiple intermediaries must still be defined, such as when one agent operates through another agent inside a browser.
Cloudflare describes identity as a spectrum that trades different degrees of information about a user. At the least identifying end, a user can bring no identifiers; a site might instead link requests to a session, or require an account-level identifier that persists across sessions. For high-risk actions, the post says a site might require a unique per-user identifier that persists across operators, accounts, agents and sessions.
The post names WBA for conveying an agent’s platform identity, MOLE for user reputation and OAuth for account identities. It also says privacy-preserving methods such as Privacy Pass and MOLE can help sites decide whether to trust a request without identifying the user. For actions requiring a fact about a person, such as age or cardholder status, Cloudflare says mechanisms are needed for sites to request that information and for operators or third parties to provide it.
Sites need machine-readable agent policies
Cloudflare says agents today infer a site’s rules by trying actions and interpreting the response, usually whether the site blocks them. The post says that approach wastes resources on both sides and in some cases makes honest agents appear malicious. It argues that sites need a machine-readable way to publish which actions agents are allowed to take.
The post says the Internet Engineering Task Force is working on preference-expression mechanisms through its AI Preferences Working Group, whose focus is on preferences for use, such as training, inference and search. Cloudflare says it has been collaborating with major operators, identity verification companies, payment providers, merchants, publishers, proxy providers and cloud browsing companies. It names Web Bot Auth, AIPREFs, OAuth, WIMSE and MOLE among the specifications and activities it is working to connect with running code.