# Cloudflare and World announced a Trusted Agent Delegation (TAD) coalition in November 2026. What is it, what problem with personal AI agents is it meant to fix for websites, and what can a site actually do about agent traffic today while it's still being worked out?

**Short answer:** It's a coalition and a problem statement, not a finished protocol. Cloudflare's November 5, 2026 post argues that when a hosted personal agent (it names Meta's Muse and OpenAI's dots) acts for many people, a site sees the agent and loses the user: it can't tell whose purchase is disputed, can only block a shared agent when one user abuses it (cutting off everyone else behind it), and can't keep risk checks, subscriptions or age limits tied to a person. Its principle is that the site–user relationship and each side's security duties must hold regardless of the intermediary. Cloudflare and World announced Trusted Agent Delegation (TAD) on November 12, 2026 to gather operators, sites, payment and identity companies and take well-defined problems to the IETF. The building blocks it names: Web Bot Auth so an agent proves which operator runs it, a planned protocol called MoLE for rate limiting without per-user identifiers, OAuth for account identity, claims (such as over 18 or cardholder) supplied by the operator or a third party, and a machine-readable site policy for what agents may do. Today, Cloudflare customers can see a Personal Assistants traffic category, set Allow, Block on pages with ads or Block per supported personal agent, and, with Account Abuse Protection (early access), see which agent made a login or sign-up and act on one account's Hashed User ID instead of blocking the agent for everyone.

## Checklist
1. Find out which personal agents already reach you. Group requests by declared agent and, where present, by Web Bot Auth signer (the Signature-Agent URL), and look at which paths they hit: product pages, login, cart, checkout, support.
2. Decide per agent and per area, not one switch for all automation. Reading product pages, logging in and buying carry different risks; Cloudflare's per-agent policy has Allow, Block on pages with ads and Block.
3. Prefer cryptographic identity over the user-agent string. Cloudflare notes attackers copy a well-known agent's user agent to get the same allowances; a verified Web Bot Auth signature tells you which operator signed the request.
4. Plan for one agent serving many users. When one user abuses a shared agent, act on that user's account or session rather than the agent, or you cut off every other customer using it.
5. Keep your own record of what each agent did on each account: the agent and signer, the account, the action, the time and what the user had authorized. That's what you'll have when a purchase made through an agent is disputed.
6. Don't count a CAPTCHA handed to the user as accountability. Cloudflare's post says it proves a human was present at that moment and nothing about who the agent acts for the rest of the time.
7. Treat TAD as a direction to follow, not a spec to build against yet. Watch the Web Bot Auth, AIPREF, OAuth and WIMSE work at the IETF, where the coalition says it will bring specific problems.

## What is Trusted Agent Delegation (TAD) from Cloudflare and World?
- TAD was previewed at Cloudflare Connect and announced by World on November 12, 2026 as a coalition to help personal AI agents reach more services under conditions those services can trust. Cloudflare describes its goal as bringing representatives across the ecosystem together to examine existing protocols and take well-defined problems to the IETF, with side meetings and workshops planned. Its site, trustedagentdelegation.org, says users should be able to share only what an interaction requires, without enabling tracking across sites.
- The scope is agents hosted by an operator, such as an agent running a cloud browser for many users. On-device and locally run agents are explicitly out of the initial scope, because there's no single operator to build reputation with or hold to account.
- In TAD's framing, "trusted" means a website trusts an agent enough to let it in. When an agent misbehaves, the aim is that the site can hold the user associated with it to account, by refusing that user service or reporting them to the agent's operator, instead of blocking the agent outright.

## Why can't a website tell which user is behind a personal AI agent?
- Cloudflare's post lists fourteen problems that agents create for sites and says the site bears the primary cost in nearly all of them. Examples: friendly fraud, where a user approves an agent's purchase and later disputes it, and the usual evidence (same device, IP and address as past purchases) doesn't exist; traffic commingling, where credential stuffing or card testing through a shared agent can only be stopped by blocking the agent for all its users; identity spoofing, where attackers copy a known agent's user agent; and resource exhaustion from constant stock and price polling.
- It also explains why common fixes fall short. Handing a CAPTCHA to the user shows a human was there once and adds friction operators will try to remove. Narrow permission scopes tell the site what the agent may do but not who answers when it gets something wrong.
- Its proposed identity spectrum runs from nothing, to a session identifier, to an account identifier that persists across sessions with one operator, to a unique per-user identifier from a third party for high-risk actions. Privacy-preserving tools such as Privacy Pass and the planned MoLE are meant to answer "can we trust you?" without "who are you?" where that's enough.

## How can a website see and control personal AI agent traffic today?
- Cloudflare's November 4, 2026 release adds Personal Assistants as a traffic category in Security Analytics, a widget listing which agents visit, how many requests each sends, the paths they request and the errors they hit, and a renamed AI Crawler and Agent access policies setting where you can set an overall Agents policy and override it per supported personal agent.
- For sites in Account Abuse Protection's early access, every login and sign-up shows whether a personal agent made it and which one, each account shows the agents acting for it, and a WAF rule on the account's Hashed User ID can stop an attacker on one account without blocking the agent for others.
- Outside Cloudflare, the same ideas apply with your own tooling: verify Web Bot Auth signatures where agents send them, key rate limits and blocks to the signer and the account rather than the IP, and log each agent action against the account it touched. The IETF Web Bot Auth draft (-01, October 29, 2026) recommends that a site expecting signatures ask for them with Accept-Signature, and notes that the identifier allows correlation across sites.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "A personal shopping agent is about to log in to a customer's account on our store. Before we let it through, check its Web Bot Auth signature and that the signer is one of the agent operators we've chosen to allow on account pages."

```json
{
  "tool": "gate_check",
  "arguments": {
    "policy": {
      "require_web_bot_auth": true,
      "allowed_signature_agents": [
        "<signer host you allow, e.g. the operator's key directory host>"
      ]
    },
    "request": {
      "method": "POST",
      "url": "<the login URL>",
      "headers": {
        "user-agent": "<as received>",
        "signature-agent": "<as received>",
        "signature-input": "<as received>",
        "signature": "<as received>"
      }
    }
  }
}
```
- Free, no key. It resolves the signer's HTTPS key directory and returns allow or deny with reasons and the signer it resolved; drop allowed_signature_agents to accept any signer whose signature verifies.
- It tells you which operator signed this request. It doesn't identify the user behind the agent, read Cloudflare's agent categories or Account Abuse Protection data, or implement TAD, which doesn't have a protocol of its own yet.
- To keep a record of what an agent did on an account, record_action returns a ledger-committed receipt of the action as you describe it; it proves what was recorded and when, not that the action happened.

_Rightshold isn't affiliated with Cloudflare, World, the TAD coalition or any agent operator named here, and can't see Cloudflare dashboards or customer data. TAD is a coalition and whitepaper, not a standard; details are as described in Cloudflare's November 4 and November 5, 2026 posts, World's November 12, 2026 announcement, trustedagentdelegation.org and the IETF Web Bot Auth draft -01, all read November 13, 2026, and may change. Not legal or security advice._

## Sources
- [Cloudflare Blog: Agents aren't humans (but they kinda are) (November 5, 2026)](https://blog.cloudflare.com/trusted-agent-delegation/)
- [World: World and Cloudflare introduce Trusted Agent Delegation (November 12, 2026)](https://world.org/blog/announcements/trusted-agent-delegation-cloudflare-world)
- [Trusted Agent Delegation: Rebuilding trust between sites, users, and their AI agents](https://trustedagentdelegation.org/)
- [Cloudflare Blog: See the agents, set the terms: new visibility and control for personal agents (November 4, 2026)](https://blog.cloudflare.com/personal-agents-visibility-control/)
- [IETF: draft-ietf-webbotauth-httpsig-protocol-01, HTTP Message Signatures for automated traffic (October 29, 2026)](https://datatracker.ietf.org/doc/html/draft-ietf-webbotauth-httpsig-protocol-01)
- [The Gate on Rightshold](https://www.rightshold.com/gate)

## Related
- [How to verify which AI agent is hitting your site with Web Bot Auth](https://www.rightshold.com/answers/how-to-verify-which-ai-agent-is-hitting-your-site-with-web-bot-auth)
- [How can an AI agent prove a verified human is behind it?](https://www.rightshold.com/answers/how-can-an-ai-agent-prove-a-verified-human-is-behind-it)
- [How to let a headless browser AI agent complete checkout without turning off bot protection](https://www.rightshold.com/answers/how-to-let-a-headless-browser-ai-agent-complete-checkout-without-turning-off-bot-protection)
- [Can you dispute a purchase your AI agent made with your card?](https://www.rightshold.com/answers/can-you-dispute-a-purchase-your-ai-agent-made-with-your-card)
- [How to set per-agent rate limits and quotas that don't throttle human browsers](https://www.rightshold.com/answers/how-to-set-per-agent-rate-limits-and-quotas-that-do-not-throttle-human-browsers)
- [Does a Cloudflare Verified bot have to obey your robots.txt, and can it lose Verified status?](https://www.rightshold.com/answers/does-a-cloudflare-verified-bot-have-to-obey-your-robots-txt-and-can-it-lose-verified-status)

_Not legal advice. Updated 2026-11-13. JSON: https://www.rightshold.com/answers/what-is-trusted-agent-delegation-and-how-would-it-tie-an-ai-agent-to-the-user-behind-it.json_