The Problem in One Scenario
Cloudflare illustrates the issue with a fictional personal assistant named Ezra, who runs errands for four different clients. A store can’t trace a disputed purchase back to a specific client. A bank that spots suspicious behavior can only ban Ezra — locking out all four users in the process.
That’s not a hypothetical edge case. It’s increasingly the default state of the web. Cloudflare reports that more than half of internet traffic is now bot-driven, and its directory of known bots and agents has passed 800 entries, growing by roughly 50 applications per week.
The trust signals websites relied on for years — device fingerprints, session history, IP addresses — don’t survive agent traffic. One agent, many users, zero visibility.
What TAD Actually Proposes
The framework has three core components: identity, reputation, and accountability. Together, they’re meant to give websites a graduated way to verify who’s behind an agent without defaulting to “block everything” or “demand everything.”
Four Tiers of User Identification
TAD defines four levels a website can require based on risk:
- Nothing — no user identifier; the site judges the agent alone
- Session — ties requests to one agent instance for that session
- Account — links a user across sessions via a stable identifier
- Unique — high-stakes actions requiring a persistent third-party credential, such as a government ID or TFH’s World ID (currently at over 40 million users, nearly 20 million verified in person)
The idea is proportionality. A content site might only need session-level signals. A bank initiating a transfer probably wants the unique tier.
Reputation and Accountability
Reputation lets sites accumulate trust in a known user even when their agent looks like automation — and flag users who rotate identities to avoid building any history at all.
Accountability closes the loop on abuse. When a site reports a bad actor, the agent operator is expected to act. Cloudflare plans to require evidence of those controls before granting verified agent or operator status. Think of it like how email providers handle spam reports — except for AI agents.
Why Existing Tools Don’t Quite Fit
TFH’s CPO Tiago Sada made a pointed observation: any signal that originates in the digital world can be faked with AI. Liveness checks, selfies, even sophisticated CAPTCHAs — they prove a human was present at one moment, not what happens next.
KYC verifies account control. 3-D Secure mostly shifts liability. MFA is useful but doesn’t address agent-specific problems. None of these were designed for a world where one agent acts on behalf of thousands of users simultaneously.
What’s Available Now
For Cloudflare customers, several tools are already live or in early access:
- Security Analytics now breaks out personal assistants as a traffic category
- Account Abuse Protection (early access) flags agent-driven logins and lets sites apply firewall rules to a hashed user ID — mitigating one bad account without blocking the agent for everyone
- Web Bot Auth lets agents cryptographically sign requests to identify themselves and their operator
- Business Insights shows Enterprise Bot Management customers how much each operator crawls versus how much traffic it sends back
TFH plans to update its agent delegation SDK to support the framework in the coming weeks.
The Bigger Picture
The coalition is inviting agent builders, runtimes, edge platforms, and compliance infrastructure to join at trustedagentdelegation.org. Side meetings at the IETF are planned, with the goal of bringing well-defined problems to the body that develops the internet’s core technical standards.
Cloudflare’s Bryan Becker put the stakes plainly: if legitimate agents don’t get better access, users will simply switch to agents that ignore the rules entirely.
That’s the real tension TAD is navigating — not just identity verification, but the incentive structure of the open web. A framework that’s too restrictive gets bypassed. One that’s too loose doesn’t solve anything.
The useful takeaway for anyone building or deploying AI agents right now: the window for self-regulation is open, but it won’t stay open indefinitely. Getting familiar with Web Bot Auth, OAuth, and emerging standards like WIMSE isn’t future-proofing — it’s catching up.
Comments (0) No comments yet
Want to join this discussion? Login or Register.
No comments yet. Be the first to share your thoughts!