Cloudflare calls for trusted identity and accountability for AI agents

AI agents create an intermediary problem

In a post dated November 5, 2026, Cloudflare describes personal AI agents as automations that take instructions from a human user and pursue a goal by controlling a cloud computer or browser. They are usually hosted and maintained by an operator as part of a managed service or consumer offering. The post names Muse from Meta and dots from OpenAI as examples.

From a website’s perspective, an agent can look like a human carrying out a task, or like one visitor acting for multiple users. That makes it harder for the site to recognize, serve and hold accountable the people behind the activity. Cloudflare says the site can end up carrying the costs when something goes wrong.

The company compares agents with cloud browsers and proxies, which also sit between a user and a site. What has changed, according to Cloudflare, is the scale and trajectory of agentic traffic. Agents can act around the clock, work in parallel and tolerate friction that would discourage a person. That challenges assumptions behind website capacity planning, security and business models.

Why CAPTCHAs and access controls are insufficient

Cloudflare illustrates the issue with Ezra, a personal assistant who runs errands for several clients. A grocer may see only Ezra rather than knowing which customer an order belongs to. If a client disputes a purchase, the store may struggle to prove who authorized it. If another client provides possible passwords and Ezra tries them at a bank, banning Ezra could also block legitimate customers.

The same problem can appear when an AI agent represents several users. A site may detect harmful activity but lack the information needed to identify the responsible user, agent or operator. Cloudflare says the site often bears the primary cost of this uncertainty.

The post argues that requiring a user to solve a CAPTCHA only proves that a human was present at that moment. It does not identify the person the agent acts for or establish who is responsible later. Tightly scoped permissions also fall short when agents need broad access to perform user tasks. A permission indicates what an agent was allowed to do, but not who answers when it makes a mistake.

Protocols for identity and responsibility

Cloudflare’s proposed direction is based on what it calls the “Intermediation Principle”: the business relationship between users and sites, along with each participant’s security responsibilities, should be upheld regardless of intermediation. The company says sites should be able to recognize, serve and hold accountable a user acting through an agent, while also recognizing and holding the agent and its operator accountable.

The post points to protocols as one part of that effort. MOLE is described as an upcoming approach intended to support rate limiting without user-specific identifiers. Cloudflare also references the x402 protocol, which aims to enable privacy-preserving payments on the web.

For agent identity, Cloudflare says Web Bot Auth, or WBA, is its preferred method. WBA allows an agent to sign its requests, helping identify the agent and, implicitly, its operator. Cloudflare says additional work is needed when multiple intermediaries are involved, such as one agent using another inside a browser.

For users, the company’s stated aim is an internet where people have equal or greater access to websites than before. It says agents should be able to support private browsing, while sensitive services such as banks may require additional verification. The proposal therefore focuses on giving sites enough information to apply their policies and assign responsibility without requiring an agent to imitate a human or keeping a person involved in every action.