Cloudflare proposes a way to verify AI agents acting on behalf of users

Cloudflare introduced a concept called Trusted Agent Delegation, aimed at a tricky problem in modern web security: AI agents that act on a person's behalf don't fit neatly into existing categories of either a trusted human user or an untrusted bot. Cloudflare's approach treats these agents as a distinct category, allowing websites and services to verify that an agent is legitimately acting for a specific user while still constraining what that agent is allowed to do. The idea is to give sites a way to grant limited, verifiable permissions to agents, rather than either blocking all automated traffic indiscriminately or trusting it blindly. As more people start delegating tasks like shopping, booking, or form-filling to AI agents, infrastructure providers like Cloudflare are trying to get ahead of the authentication and access control challenges this creates, before it becomes a bigger security and fraud problem across the web.

Why it matters

A concrete proposal for authenticating AI agents online, addressing a gap that current web security models weren't built for.

Source: Cloudflare