Cloudflare lets site owners see and limit each personal agent that visits

Cloudflare said on 4 November that site owners can now see each personal AI agent that visits a site. The owner can set a separate access rule for each one. The post is on the Cloudflare blog. A personal agent is an agent that acts on one named person's behalf. Examples are ChatGPT's and Claude's shopping and browsing agents. The controls sit in the Cloudflare dashboard, not in code.

What a site owner sees

The main new panel is called Personal Assistants, inside Top statistics. It lists which agents visit the site. It shows how many requests each agent sends. It lets the owner filter on one agent, so every other widget on the page shows only that agent's requests. The owner can read which URLs the agent asked for, the status codes Cloudflare returned, and the error rate.

Cloudflare's Account Abuse Protection is in early access. For sites that use it, the panel ties each agent session to the account it represents. A fraud team can see which human user each agent worked for. The account overview shows every agent that acted for that account. A fraud analyst looking at a strange login can tell whether it came from a trusted agent. Or it may be an agent the account has never used.

What a site owner can decide

Cloudflare added agent policies to its AI bot controls this summer. The policies this week extend to one setting per supported personal agent. Three choices are available: Allow, Block on pages with ads, or Block. The overall Agents policy still sets the default, and a per-agent setting overrides it.

Cloudflare gives a worked example. Set the overall Agents policy to Block on pages with ads. Then allow a specific personal agent across the whole site. During onboarding for a new zone, Cloudflare asks whether the site shows ads. It tailors the recommended policies to the answer. The policies can be changed later in Security Settings.

The reasoning differs by site. Cloudflare's post names two cases. A publisher may allow a specific personal agent on every page so readers can find its articles. Another publisher may block that same agent on pages where ads pay for the content.

What this changes for a team that owns a site

A site owner today sees AI crawler counts through Cloudflare's existing bot dashboards. A personal agent is harder to see. It arrives through many IP addresses for one person. Cloudflare says its verified bot directory, which it calls the largest in the world, now feeds this new panel. That turns unexplained automated traffic into traffic the owner can decide on.

A site that already blocks Training bots and allows Search bots can now treat Agent bots the same way. It can do that one supported agent at a time. A publisher that sells ads can block an agent on ad pages. The same publisher can let that agent read a free archive.

Two limits are stated in the post itself. Cloudflare says the per-agent rules apply to "supported" personal agents. The operators named are Google, OpenAI and Anthropic. Cloudflare also says the next goal is wider. It wants to carry user context through an agent. It wants sites to judge an agent's reputation. It wants to set accountability when something goes wrong. None of that is in this week's release. Cloudflare says it will share more as it works with agent operators and standards groups.

Source

• See the agents, set the terms, Cloudflare