Cloudflare adds visibility and access controls for personal agents
Cloudflare is launching analytics and more granular access policies for personal agents, giving site owners a clearer view of automated activity and more control over which agents can access their sites. The company says the tools are designed to help businesses welcome agents without giving up control of their traffic, accounts, and content.
- Security Analytics now categorizes Personal Assistants separately.
- A new widget shows which agents visit a site and how many requests they send.
- Account Abuse Protection users can connect agents with specific accounts.
- Policies can allow, block, or block agents on pages with ads.
- Search and Training policies remain unchanged.
New analytics identify personal agent traffic
Personal agents turn a person’s instructions into requests and actions on websites. They may compare products, find support articles, or complete a purchase. To a website, those interactions can otherwise appear as unexplained automated traffic.
Cloudflare’s Security Analytics now includes Personal Assistants as a category in the Bot Analysis chart, alongside Verified Bot, Likely Human, Likely Automated, and Automated. Security teams can select the category to view personal agent traffic over time.
A new Personal Assistants widget in Top statistics lists the agents visiting a site and the number of requests each sends. Filtering for one agent updates the other widgets to show its requested paths, received status codes, and source networks. Site owners can see whether an agent is logging in, reading product pages, reaching checkout, or encountering errors.
Account tools connect agents with users
For sites using Account Abuse Protection, which Cloudflare says is currently in early access, owners and fraud teams can see which user each agent represents. The population overview shows the personal agents active across users and the number of accounts using them.
Login and sign-up events now indicate whether a personal agent made the request and identify the agent. Fraud teams can filter accounts by AI assistant events or by the number of AI assistants. Each account overview also shows the agents acting for that account.
Cloudflare says this can help analysts distinguish an agent a customer has relied on for weeks from one appearing for the first time. If an attacker appears to be using an agent on an account, analysts can mitigate the account directly with a WAF rule on its Hashed User ID, without blocking that agent for everyone else.
Site owners can set different policies for supported agents
Cloudflare is expanding its existing Agents policy to support more granular controls for supported personal agents. The company is renaming the AI Crawler and Agent access policies section and adding per-agent choices in Security Settings.
Owners can set an overall Agents policy and then choose Allow (do not block), Block on pages with ads, or Block for each supported personal agent. For example, a site can block agents on pages with ads while allowing a selected agent across the site. Existing Search and Training policies remain unchanged.
Cloudflare says its longer-term goal is to preserve more user context when agents act as intermediaries, including what a user authorized, whether they are an existing customer, and which protections should apply. For now, the tools let businesses review agent activity and choose access terms suited to their sites.
