Cloudflare Publishes a Position Paper on Agents and Sites and Announces the TAD Coalition: Fourteen Site-Side Challenges and a Plan Built on Web Bot Auth and MOLE, but the Standards Are Mostly Drafts, the White Paper Is Not Out and the Shipped Controls Cover Only Cloudflare Traffic

On November 5, 2026, Cloudflare published "Agents aren't humans (but they kinda are)", a long position paper by Bryan Becker, and announced the Trusted Agent Delegation (TAD) coalition. It follows the November 4 product post on visibility and control for personal agents, which this issue does not repeat; the new part is the argument and the standards plan. The paper is advocacy by a vendor that sells bot and access controls, so the claims about cost and need are Cloudflare's own framing.

The starting point is that a personal AI agent is an intermediary. It acts for a user, is usually run by an operator as a managed service, and reaches a site from the operator's infrastructure. The site sees the agent and not the user, and one agent may carry many users. Cloudflare says a site normally needs three things to manage that relationship: identity, reputation and accountability. Its single organizing principle, which it calls the Intermediation Principle, is that the business relationship between users and sites, and each party's security responsibilities, must be upheld whatever sits in between. The paper gives two examples of operators, Muse from Meta and dots from OpenAI, and says agentic traffic may eclipse ordinary human browsing in the near future, which would make the old answer of blocking intermediaries unworkable.

To make the problem concrete, the paper uses a story about a personal assistant named Ezra who runs errands for four clients, and then a table of fourteen site-side challenges. Among them are account sharing, friendly fraud, identity spoofing, traffic commingling (when one client abuses a shared agent, the site can block only the agent and so blocks all its users), resource exhaustion, uncompensated consumption of content, and the fact that CAPTCHAs and risk-based authentication stop working as designed. Cloudflare concludes that in nearly every case the site bears the primary cost. That is a claim supported by reasoning and examples, not by measurements, and the paper does not quantify any of the fourteen.

Cloudflare also explains why two common proposals fall short. Passing a CAPTCHA to the user proves only that some human is present at that moment, does not say who the agent acts for the rest of the time, and puts back the friction agents exist to remove. Narrow access scopes are rarely used in practice, because agents ask for permission to do everything, and even a narrow scope says what the agent may do, not who answers when it goes wrong.

The proposed direction is a set of existing and emerging standards. For identity, Cloudflare prefers Web Bot Auth, where an agent signs its requests; its documentation says it is based on IETF drafts, uses Ed25519 keys, and expects a key directory at a fixed well-known path. The paper notes an unsolved case, an agent that uses another agent inside a browser, where the site must see the whole chain. The documentation adds that Cloudflare is experimenting with the Forwarded header to carry an operator's identity through such a chain, and marks that as experimental and subject to change. For rate limiting without user identifiers it points to MOLE, which it calls the intended successor to Private Access Tokens, and for payments to x402. It describes four levels of identifying information, from nothing, through a session and an account, to a unique identifier from a third party, and says sites should ask for no more than they need. It also asks for a way to carry claims such as being over 18 or being the cardholder, and for a machine-readable way for sites to publish what agents may do, noting that the IETF AI Preferences working group covers use preferences like training and search but, in Cloudflare's view, not the wider need.

The TAD coalition is the announcement. Its stated goal is to bring representatives from across the ecosystem to discuss the problem set, examine existing protocols, and take well-defined problems to the IETF, with side meetings at IETF meetings and workshops. The coalition's site says a white paper is coming soon and shows one intended use case, a returning shopper who switches agents while the site keeps its relationship with the shopper and limits the personal information shared. The paper says local and open-source agents running on a user's own device are not the first focus.

The paper closes with what Cloudflare customers can do now, which restates the November 4 features: Security Analytics counts personal assistants as their own traffic category, per-agent access policies let a site allow an agent, block it only on pages with ads, or block it entirely, and Account Abuse Protection, which is early access, shows whether a login or sign-up came from a personal agent and which one, so a single account can be mitigated by a WAF rule on its hashed user ID. The paper names Business Insights, a reporting tool for Enterprise Bot Management customers, for the wider picture of AI crawler traffic.

Our reading: the useful part is the vocabulary and the list of failure cases, which let a site owner check which of the fourteen apply. The standards are mostly drafts, MOLE is described as intended, the white paper is not yet published, and the shipped controls cover only Cloudflare traffic. Treat the coalition as a stated intention, not as an adopted standard.