Cloudflare adds personal agent analytics and access policies

Cloudflare announced new analytics and more granular access policies for personal agents that act on behalf of humans. The tools are meant to help site owners understand which agents visit their sites, what they do, and set access terms that fit their business. Owners can review agent activity in Security Analytics and configure policies in Security Settings.

See how agents access your site

Cloudflare's verified bot directory now informs traffic details. In Security Analytics, the Bot Analysis chart adds Personal Assistants as a category alongside Verified Bot, Likely Human, Likely Automated, and Automated. Security teams can select it to view personal agent traffic over time. A new Personal Assistants widget in Top statistics lists visiting agents and request counts, and filtering on one agent updates other widgets with its paths, status codes, and networks. For sites using Account Abuse Protection in early access, owners and fraud teams can see which user each agent represents. The population overview shows which personal agents are active across users and how many accounts use them. Login and sign-up events show whether a personal agent made the request and which one. Fraud teams can filter accounts by AI assistant events or number of AI assistants. Each account overview shows agents acting for that account, and analysts can mitigate a specific account with a WAF rule on its Hashed User ID without blocking the agent for others.

Set access policies that reflect your preferences

Cloudflare is expanding the existing Agents policy and renaming the setting AI Crawler and Agent access policies. In Security Settings, owners can set an overall Agents policy, then choose a different policy for each supported personal agent: Allow (do not block), Block on pages with ads, or Block. For example, an owner can set the overall policy to Block on pages with ads and choose Allow for a supported agent. Search and Training policies remain unchanged. Owners can also make these choices during onboarding when adding a new zone; Cloudflare asks whether pages are monetized with ads and tailors recommended policies. Policies can be revisited later in Security Settings.

Agent identity is only part of the story

The analytics and policies give site owners visibility and control. Cloudflare's next goal is to help sites preserve user context when personal agents act as intermediaries. A site may recognize the agent but lack information about the user, such as whether they are an existing customer, what they authorized, whether they have a subscription, or which protections should apply. Reaching that goal requires privacy-aware ways to carry user context through an agent, help sites assess reputation, and establish accountability when something goes wrong. Cloudflare says it will share more as it works with agent operators and others across the ecosystem.

Make the choice for your site

Site owners can review how personal agents access their site, then visit Security Settings to AI Crawler and Agent access policies and set terms that work for their site. The article notes that a person asking an agent to compare products, find support, or complete a purchase is still a customer trying to reach a business.

Sources: Cloudflare