Cloudflare and Tools for Humanity Propose Identity Framework for AI Agents

Cloudflare and Tools for Humanity are proposing a shared identity framework for AI agents, aiming to let websites tell legitimate agent activity from abuse without blocking agents outright or forcing every user to reveal who they are.

The proposal, called Trusted Agent Delegation, was published by Cloudflare in a blog post by Bryan Becker, director of product for integrity and trust, alongside a coalition site at trustedagentdelegation.org. Becker presented it in a joint session with Tiago Sada, Tools for Humanity's chief product officer; the two invited feedback and said a working group of agent builders, KYC providers and payment providers is being formed.

The pressure behind the work is traffic. Cloudflare says more than half of internet traffic is now driven by bots, a figure that predates the recent wave of consumer personal agents. Becker expects the share to climb toward 99%, and Cloudflare's directory of known bots and agents has passed 800 entries and is growing by roughly 50 applications a week.

The core problem is attribution. When an assistant acts for several people, a merchant cannot prove which customer authorized a disputed purchase, and a bank that spots one client's password guessing can only ban the assistant, locking out everyone else. Sites once tied devices, IP addresses and browsing history to a single user; now many users arrive through one agent and look identical. Cloudflare's post lists 14 ways this strains the site-user relationship, from friendly fraud and shared subscriptions to scraping and resource-heavy agents. A survey of 2,026 U.S. adults found that 68% use an AI agent at least weekly for a personal task, yet half are uncomfortable letting one use their card details and 43% doubt they could tell whether an agent's request is legitimate.

Existing defenses answer the wrong question, the partners argue. CAPTCHAs show only that a human was present at one moment, KYC proves control of an account, and robots.txt can say where a crawler may go but not what an agent may do. Tightly scoped permissions help less than expected because agents typically request broad access, and a restrictive agent may simply lose users to an unrestricted one.

TAD rests on three pieces: identity, reputation and accountability. It defines four tiers of user identification — nothing, session, account and unique — that a site can require according to risk, from judging only the agent to demanding a persistent third-party identifier such as a government ID or proof of personhood for high-risk actions. Reputation lets sites accumulate trust in a known customer even when the traffic looks automated, and accountability requires operators to act on reports about abusive users rather than leaving sites to block an entire agent.

The framework builds on Cloudflare's Web Bot Auth, which lets agents cryptographically sign requests to identify themselves and their operator, and on its verified bot program. Cloudflare customers can already break out personal assistants in Security Analytics, set per-page agent policies and, in early access, flag whether a personal agent initiated a login or sign-up. The coalition's next step is to bring concrete problems to the IETF and tighten the requirements for verified agent status; no timelines were given.

"We need to make sure these agents have more access," Becker said. "If we don't, another agent will come along that just doesn't follow the rules and end users will use that one anyway." The bet is that graduated identification, rather than blanket blocking, keeps the agent economy inside rules that sites can enforce.