World and Cloudflare introduce Trusted Agent Delegation

Cloudflare and World introduced Trusted Agent Delegation (TAD), a coalition aimed at helping personal AI agents access more services under conditions those services can trust. The underlying concept is outlined in a whitepaper here. To review more information and join the discussion visit, trustedagentdelegation.org.

Initially previewed at Cloudflare Connect, TAD’s goal is to add trust between human-delegated agents and websites, which requires identity, reputation, and accountability. The presentation from Cloudflare Connect is available for replay here.

Bots make up over half of all web traffic, and that number continues to grow. Agents are automating more actions online, researching products, comparing prices, and booking travel on behalf of individuals. Today, websites see the agent but lose the human. Apps and services now need to be able to recognize and serve a new type of customer.

Turning every agent away costs websites and apps revenue and frustrates the people who rely on agents. It also limits what agent builders can offer.

Why websites lose sight of the individual behind an agent

Agents have broken a fundamental part of how the web works, making it difficult for apps and services to know which agents are acting with good intentions or on behalf of an individual. Fraud prevention on the web relies heavily on analyzing an individual’s behavior when they visit websites. But when actions are delegated to an agent, the agent makes requests from the agent builder’s infrastructure, mixed in with requests from everyone else that agent serves. Websites see the agent but lose the human.

That leaves websites with few good options. Websites may block an entire agent service because they cannot distinguish requests from different individuals. Tools like CAPTCHAs and multi-factor authentication alone do not establish which individual a hosted agent represents.

What “trusted” means in an agentic world

People get agents that complete tasks for them. Agent builders get agents that work on more of the web. Websites get customers they can confidently serve.

Individuals delegate tasks to their agents, while websites set the conditions under which those agents can interact with their services. Within the TAD framework, “trusted” describes whether a website trusts an agent enough to let it in. Agent builders benefit when websites trust their agents. When an agent misbehaves, TAD is designed to let websites hold the individual associated with the agent accountable. A website can refuse them service or report them to their agent builder, who may choose to restrict their access.

Meeting the needs of the agentic web

Much of what’s needed for TAD already exists:

• Protocols - Agents and websites can engage in explicit protocols for solving some of the problems above. MoLE is one upcoming approach that aims for rate limiting without user-specific identifiers, allowing websites to transition away from implicit identities and towards explicit protocols for accomplishing the same goal.
• Identities - For cases where identifiers are needed, the tools exist or are being refined. Web Bot Auth already lets an agent sign its requests, which provides a secure way for an agent to identify itself (and, implicitly, the agent operator). The framework still needs a mechanism that supports multiple intermediaries. Other types of identifying information, such as session, account, or even user-specific IDs, might be necessary, depending on the context.
• Claims - Some actions require an agent to demonstrate a fact about the individual it represents, such as whether they are over 18 or the cardholder. In order to allow personal agents access to websites or actions with these kinds of restrictions, we need mechanisms for websites to request this information, and for operators or third parties to provide this information.
• Site agent access policy - Websites need a machine-readable way to state what agents can do and what requirements apply. The IETF is actively working on many mechanisms for this through the aipref working group. It is in this group that extensions to policies will be explored.
• On open source and local agents - The working group will initially focus on agents hosted by an operator whose reputation websites can assess. On-device and locally hosted agents raise different questions about reputation and accountability and fall outside this initial scope.

Participate and contribute to TAD

TAD was initially previewed at Cloudflare Connect. Following that introduction, a whitepaper was published outlining the need for TAD. Join the discussion at trustedagentdelegation.org.