Cloudflare adds visibility and access controls for personal agents
Cloudflare has introduced new analytics and access-policy options intended to help website operators identify personal agents visiting their sites and decide how those agents may interact with pages. The changes address a growing operational challenge: requests made by an agent on a person’s behalf can appear as automated traffic, even when the person is trying to browse products, find support information or complete a purchase.
Cloudflare says the new controls are designed to let site owners evaluate agent activity rather than treating all such requests as a single category. The company is adding personal-agent traffic details to Security Analytics and expanding its existing agent access policies. These tools let operators examine which agents are making requests and choose different rules for supported agents.
Personal-agent traffic becomes a distinct analytics category
In Security Analytics, the Bot Analysis chart now includes Personal Assistants alongside Verified Bot, Likely Human, Likely Automated and Automated. Selecting the new category filters the view to personal-agent traffic over time.
A Personal Assistants widget in Top statistics lists the agents visiting a site and the number of requests associated with each. Operators can filter on an individual agent, with the other widgets updating to show its requested paths, response status codes and originating networks. That information can help teams distinguish, for example, requests reaching product pages or checkout from requests encountering errors or attempting to access areas the agent cannot use.
The added visibility may help security and business teams make more informed access decisions, but identifying an agent does not by itself establish what a user authorized it to do. Cloudflare acknowledges that sites may recognize an agent while lacking useful user context, such as whether the person is an existing customer, has a subscription or granted the agent permission for a particular action.
Account-level details for Account Abuse Protection users
For customers using Account Abuse Protection, which Cloudflare says is currently in early access, the new views can associate agent activity with user accounts. A population overview shows which personal agents are active across users and how many accounts use them. Login and sign-up events indicate whether a personal agent made the request and identify the agent.
Fraud teams can filter accounts by AI assistant events or by the number of assistants associated with them. An individual account overview also shows agents acting on that account. This could provide additional context during an investigation—for instance, helping an analyst compare an agent seen repeatedly with one that has appeared for the first time. The information is a signal for review, rather than proof that an account or agent is malicious.
Cloudflare says analysts can mitigate an account they believe is being misused by applying a Web Application Firewall rule to its Hashed User ID. That approach is intended to target the affected account without blocking the same personal agent for other customers who rely on it.
More granular policies for supported agents
Cloudflare is expanding its existing Agents policy, which forms part of the settings it previously introduced for AI bots used for Search, Training and Agent behaviors. The setting is being renamed AI Crawler and Agent access policies. Within Security Settings, site owners can establish an overall Agents policy and set a different choice for each supported personal agent.
The available choices are Allow (do not block), Block on pages with ads, and Block. For example, a site could apply the ads-related restriction generally while allowing a particular supported agent. Search and Training policies remain unchanged, according to Cloudflare. Operators can also make policy choices while adding a new zone; onboarding asks whether the site monetizes pages with ads and uses the answer to tailor recommended policies. The settings can be revisited later.
The options leave policy decisions with each site owner. A publisher may allow an agent across its content, while another may restrict that agent on ad-supported pages. Teams should assess how those choices align with their site’s business model and the functions users expect to access, then review agent traffic and policy effects over time.
User context remains an open issue
Cloudflare describes the current analytics and controls as a step toward managing agent access, while identifying user context and accountability as areas still to address. The company says future work will focus on privacy-aware ways to carry user context through agents, assess reputation and establish accountability when problems occur. It has not provided further implementation details in the announcement.
For now, operators can use the new traffic views to understand which supported personal agents are reaching their sites and configure allow or block decisions in Security Settings under AI Crawler and Agent access policies. Account Abuse Protection’s account-level features are subject to its early-access status.
