Cloudflare and Tools for Humanity propose AI agent identity framework

Websites can increasingly identify the AI agents accessing their services, but not necessarily the people behind them, what actions they authorized or who is accountable when something goes wrong. Cloudflare and Tools for Humanity (TFH) are proposing a framework to close that gap, allowing websites to distinguish legitimate agent activity from abuse without blocking agents altogether or requiring every user to disclose their identity. Their Trusted Agent Delegation (TAD) initiative combines graduated levels of user identification with reputation and accountability mechanisms, aiming to preserve the relationship between websites and customers as AI agents increasingly act on their behalf. A third option for websites Cloudflare published the framework on November 5, 2026, in a blog post by Bryan Becker, Director of Product for its Integrity and Trust products, and launched a coalition site at trustedagentdelegation.org. Becker presented it in a joint session with Tiago Sada, Chief Product Officer at Tools for Humanity, where the two invited feedback and said a working group of agent builders, KYC providers, payment providers and others is being formed. The urgency, Becker said, comes from the numbers. Cloudflare has reported that more than half of internet traffic is now driven by bots, and that figure predates the wave of personal agents that millions of consumers adopted in recent weeks. "I personally believe that while that's 51 percent right now, we're going to see 99 percent pretty quickly," he said. Cloudflare's own directory of known bots and agents has passed 800 entries and is growing by around 50 applications a week. The missing link between agents and users Cloudflare illustrates the problem with Ezra, a personal assistant running errands for four clients. A store cannot prove which client authorized a disputed purchase because it only dealt with Ezra, and a bank that spots one client's password guessing can only ban Ezra, locking out the other three. The businesses have no issue with Ezra herself; they simply cannot see the people she acts for. AI agents put websites in the same position. Where a site once tied a device, IP address and browser to one user and built trust over time, many users now egress through a single agent and look identical. Cloudflare's post lists 14 ways this strains the site-user relationship. In short, sites lose money to friendly fraud, shared subscriptions, content scraping and resource-hungry agents; security tools such as risk-based authentication and identity verification misfire or get spoofed; and blocking one bad user means blocking everyone using the same agent. Two recent surveys show the same tension on both sides of the Atlantic. In the U.S., a poll of 2,026 adults released on November 2 by fraud prevention firm SEON found that 68 percent use an AI agent at least once a week for a personal task, yet half are uncomfortable letting one use their card details and 43 percent doubt they could tell whether an agent's request is legitimate. In Europe, Signicat's "Battle to Onboard" report found 95 percent of financial providers plan to support applications started by authorized AI agents, but only 15 percent of 4,050 consumers would trust AI to use their digital identity. Both point the finger the same way when things go wrong: 65 percent of SEON's respondents would hold the company behind the agent responsible for fraud, and 43 percent of Signicat's would blame the AI provider for a failed application. That expectation sits uneasily with today's reality, in which the site absorbs most of the cost, and it is precisely the accountability gap TAD sets out to close. Providers in the Signicat study are already worried about the same questions, from confirming the customer authorized an application to verifying a real person consented. Faced with this, Sada said, many sites have simply locked agents out, citing Amazon and banks such as JPMorgan Chase. The alternative, demanding more data from users, adds friction and erodes privacy. Why existing defenses fall short The partners argue that the existing toolkit was built for a different problem. Sada's starting point is that any signal that originates in the digital world can and will be faked with AI. Identity documents were faked long before AI, selfies were quickly broken, and even liveness checks are being overcome, sometimes within 12 months of a new signal being introduced, according to Sada. Other tools still work but answer the wrong question. CAPTCHAs, including sophisticated ones, prove only that a human was present at one moment, not what happens afterwards, and with agents the site is not expecting a human anyway. Passing the CAPTCHA to the user for a human-in-the-loop check suffers the same flaw, cannot identify which user is behind the agent, and runs against agent operators' incentive to remove friction. KYC and identity verification attest to control of an account, which Sada described as the wrong test in the agent world. 3-D Secure has become mainly a mechanism for shifting liability, and MFA, while useful, does not address the problem. Tightly scoped access controls, a frequently proposed fix, may not be enough either, in the partners' view. Agents typically request and receive broad permissions, and if one agent is restrictive while another runs with no limits, consumers may prefer the unrestricted one. Cloudflare's post adds that the implicit signals sites have long leaned on, such as device, session and history fingerprinting, generally do not survive agent traffic, and that robots.txt can say where a crawler may go but not what an agent may do. Four levels of user identification The TAD framework rests on three pieces the partners say are missing today: identity, reputation and accountability. The framework defines four tiers of user identification that websites can require according to risk. In the "nothing" tier, users bring no identifier and the site can judge only the agent. The "session" tier ties a session's requests to one agent instance, so the site can act on that session without affecting the agent's other users. The "account" tier links a user's requests across sessions through a stable identifier from the operator or a third party. The "unique" tier, for high-risk actions, uses a third-party identifier that persists everywhere, such as a government ID or a proof-of-human credential like TFH's World ID, which Sada said now counts more than 40 million users, nearly 20 million verified in person. Persistent identifiers could improve accountability, though their use across services also raises questions about privacy and linkability. Reputation builds on those identifiers, letting sites accumulate trust in a known customer even when their agent looks like automation, while spotting users who rotate identities to avoid having any history. Accountability closes the loop: when a site reports the few abusive users of an agent, the operator must act against them so the site does not have to block the agent for everyone, much as email providers act on spam reports. Cloudflare plans to require evidence of this before granting verified agent or operator status. What websites can do now The framework is meant to build on existing infrastructure rather than replace it. Web Bot Auth, Cloudflare's preferred method for agent identity, lets agents cryptographically sign requests to identify themselves and their operator. Cloudflare's verified bot and agent status requires that an agent identify itself securely, behave as it claims and not commit abuse, and the company's baseline recommendation to most sites is to allow verified bots and agents. For Cloudflare customers, Security Analytics now breaks out personal assistants as a traffic category and shows each visiting agent's request volumes, paths and errors, while Business Insights shows Enterprise Bot Management customers how much each operator crawls compared with the traffic it sends back. Access policies let sites allow, restrict or block agents per site or per page, and Account Abuse Protection, in early access, flags whether a personal agent made a given login or sign-up request and lets a site apply a firewall rule to a hashed user ID, mitigating one account without blocking the agent for everyone. The post also points to emerging protocols including MOLE for rate limiting without user-specific identifiers, x402 for privacy-preserving payments, OAuth and WIMSE, as well as the AI Preferences working group at the Internet Engineering Task Force (IETF), the body that develops the internet's core technical standards. On the TFH side, Sada said the company will update its existing agent delegation SDK to support the framework in the coming weeks and months. From framework to implementation The coalition's immediate job is to convene representatives from across the ecosystem, examine existing protocols and bring well-defined problems to the IETF, with side meetings at the IETF and future workshops planned. Cloudflare says it will co-author and refine Web Bot Auth and MOLE and deploy implementations at scale as the standards mature. It will also shortly tighten what it takes to be a verified agent or verified operator, requiring operators to show evidence of the controls they have in place to provide accountability for their users. No timelines were given for these steps. Builders of agents, agent runtimes, edge and cloud platforms, and compliance and commercial infrastructure are invited to join through the coalition site. Becker framed the effort as a matter of keeping agents inside the rules rather than locking them out. "We need to make sure these agents have more access," he said. "If we don't, another agent will come along that just doesn't follow the rules and end users will use that one anyway."