Cloudflare Calls for Accountable Web Agents

Cloudflare argues that websites need ways to recognize and hold accountable both users and operators when remotely hosted AI agents browse on users’ behalf. Such agents can act around the clock, in parallel, and with less friction than people; websites may see one agent serving many users instead of the individuals behind it. Cloudflare calls the principle that user-site relationships and security responsibilities should persist through intermediaries the “Intermediation Principle.”

The post describes problems websites face when they cannot distinguish users behind agents: subscription sharing, legal age or location checks, disputed purchases, identity spoofing, failed identity checks, mistaken orders, policy circumvention, and resource exhaustion from constant checks of stock, prices, search, inventory, or support. A site may detect credential stuffing, scraping, or card testing by one user but only block the shared agent, cutting off its legitimate users too. Agents can also extract articles, product data, and reviews without generating a site visit, ad impression, or purchase, while the site pays to serve that content.

Cloudflare says human verification passed to a user proves only that a person was present at that moment; it does not identify who the agent represents or who answers for its actions. Broad access permissions also do not establish accountability, even when narrowly scoped. The company’s stated aim is to preserve users’ access to sites while giving sites information needed to apply checks when appropriate, including for sensitive actions such as logging into a bank.

The post calls for protocols that let agents and sites agree on allowed actions and communicate site policies. It cites MOLE as an upcoming approach to rate limiting without user-specific identifiers, and compares its privacy-preserving aim with the x402 payment protocol. Cloudflare says Web Bot Auth is its preferred method for agent identity because it lets agents sign requests and identify themselves and, implicitly, their operators. The post says sites also need a way to understand chains of intermediaries—for example, when Agent A uses Agent B inside Browser C—and that session, account, or user-specific identifiers may be needed in some situations. Privacy Pass and MOLE are cited as ways to assess trust without identifying a user; Cloudflare describes MOLE as a successor to Private Access Tokens. The supplied text ends as it begins listing graduated levels of identity disclosure.

Cloudflare argues that websites need ways to recognize and hold accountable both users and operators when remotely hosted AI agents browse on users’ behalf. Such agents can act around the clock, in parallel, and with less friction than people; websites may see one agent serving many users instead of the individuals behind it. Cloudflare calls the principle that user-site relationships and security responsibilities should persist through intermediaries the “Intermediation Principle.”

The post describes problems websites face when they cannot distinguish users behind agents: subscription sharing, legal age or location checks, disputed purchases, identity spoofing, failed identity checks, mistaken orders, policy circumvention, and resource exhaustion from constant checks of stock, prices, search, inventory, or support. A site may detect credential stuffing, scraping, or card testing by one user but only block the shared agent, cutting off its legitimate users too. Agents can also extract articles, product data, and reviews without generating a site visit, ad impression, or purchase, while the site pays to serve that content.

Cloudflare says human verification passed to a user proves only that a person was present at that moment; it does not identify who the agent represents or who answers for its actions. Broad access permissions also do not establish accountability, even when narrowly scoped. The company’s stated aim is to preserve users’ access to sites while giving sites information needed to apply checks when appropriate, including for sensitive actions such as logging into a bank.

The post calls for protocols that let agents and sites agree on allowed actions and communicate site policies. It cites MOLE as an upcoming approach to rate limiting without user-specific identifiers, and compares its privacy-preserving aim with the x402 payment protocol. Cloudflare says Web Bot Auth is its preferred method for agent identity because it lets agents sign requests and identify themselves and, implicitly, their operators. The post says sites also need a way to understand chains of intermediaries—for example, when Agent A uses Agent B inside Browser C—and that session, account, or user-specific identifiers may be needed in some situations. Privacy Pass and MOLE are cited as ways to assess trust without identifying a user; Cloudflare describes MOLE as a successor to Private Access Tokens. The supplied text ends as it begins listing graduated levels of identity disclosure.