Agents Aren't Humans (But They Kinda Are): The "Who Is This For?" Problem Sites Can't See

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Today I'm sharing a blog post that made me think. As AI agents multiply, what gets harder for websites?

What was announced?

In the Cloudflare blog post "Agents aren't humans (but they kinda are)", Cloudflare defines the problem of agents hiding the user from the sites they visit, and proposes a collaborative approach to safely identifying, allowing, and managing this automated traffic.

Why it matters

Personal AI agents act for a huge number of people, but a site sees only the intermediary agent, not the user. The post uses an analogy: when an assistant named Ezra runs errands for several clients, a shopkeeper sees only Ezra. They can't tell whose order is whose, can't settle disputes over unauthorized purchases, and can't turn away one abusive client without turning away all of them.

The post says sites struggle to answer three questions:

• Is this person who they claim to be?
• Can they be trusted?
• Who is responsible for an action?

When something goes wrong, sites mostly absorb the refunds, support work, fraud losses, and infrastructure costs.

What changes

The proposal is the Intermediation Principle: the relationship between users and sites, and each party's security responsibilities, should hold even with an agent in between. Agents need not behave like humans and a human need not be present for every action, but sites need ways to get or require user information when necessary.

Dive Deep

Some of the listed challenges

• Account sharing and commingled traffic: blocking an abusive agent also blocks its legitimate users
• Friendly fraud: agent purchases lack the device, IP, and address history sites use against disputes
• Broken verification: CAPTCHAs, liveness checks, and KYC assume a human is present
• Spoofing: attackers copy well-known agents' user-agent strings to gain their permissions
• Resource exhaustion: constant polling and free-trial abuse

Alternatives the post rejects

• Human-in-the-loop (passing CAPTCHAs to users): it only proves a human was present at one moment and can't identify the user
• Fine-grained access scopes: agents tend to request everything, and scopes don't say who is responsible when something goes wrong

Example mechanisms

• Web Bot Auth (WBA): agents cryptographically sign requests, identifying the agent and its operator
• MOLE (Moderation of Unlinkable Endorsements): an emerging way to rate limit without user-specific identifiers
• x402: a protocol for privacy-preserving web payments

Graduated identity levels

• Nothing: no identifiers. Trust tokens such as Privacy Pass can still establish trust
• Session: links requests within one session to a single agent
• Account: links requests across sessions to the same user account
• Unique: a per-user identifier persisting across operators, agents, and sessions, provided by a third party and reserved for high-risk actions or strict compliance

The post also covers claims (facts such as being over 18) and machine-readable access policies for agents.

The coalition and what you can use today

Trusted Agent Delegation (TAD) is a new coalition of operators, identity providers, payment companies, merchants, publishers, proxy providers, and cloud browser companies. It will examine existing protocols and bring well-defined problems to the IETF.

The post lists what Cloudflare customers can do now:

• Use Security Analytics to see personal assistant traffic by category, with each agent's request volume, paths, and errors
• Use AI Crawler and Agent access policies to allow, restrict by page, or block specific agents
• Use Account Abuse Protection (early access) to see which agent made a login or signup request, and mitigate a compromised account with a WAF rule without blocking the agent for other users

Wrap-up

• Sites can't see the user behind an agent, which raises identification, trust, and accountability problems
• The proposal centers on the Intermediation Principle
• Identity comes in four levels: nothing, session, account, and unique
• The TAD coalition plans to bring problems to the IETF
• Cloudflare starts with visibility, per-agent access control, and per-user mitigation

This is for site operators receiving agent traffic, and for anyone building agents!