Cloudflare announces the Trusted Agent Delegation coalition and four tiers of user identification for AI agents
On November 5, 2026, Cloudflare announced the Trusted Agent Delegation (TAD) coalition to work on how sites recognize and hold accountable users acting through AI agents, with four identification tiers: nothing, session, account, unique.
What happened
Cloudflare announced the Trusted Agent Delegation (TAD) coalition on November 5, 2026, in a long blog post that doubles as its whitepaper. TAD is a coalition, not a standard. It plans to bring operators, identity verifiers, payment providers, merchants, publishers, proxy and cloud browsing companies together, review existing protocols, and take well-defined problems to the IETF. Neither the post nor the coalition site names individual members.
The post sets out four tiers of user identification a site may need when a user acts through an agent:
- Nothing: the user brings no identifier.
- Session: the site can link requests in one session to a single agent.
- Account: the site can attribute requests to the same user across sessions.
- Unique: the site needs a unique, per-user identifier provisioned by a third party.
It also points to existing building blocks: Web Bot Auth, the Personal Agent Protocol's sessions, and Privacy Pass and MOLE for rate limiting without user-specific identifiers.
Why it matters
Sites currently get two options for agent traffic: block it as bots, or let it log in as the user. The tiers describe the space in between, and they attach a privacy cost to each step. That gives product, security and privacy teams a shared vocabulary for deciding how much to know about an agent's user.
Deepak's take
The tiers are the most useful thing in the post. They turn "should we identify agents?" into "which tier does this route need?", which is a question teams can actually answer and document.
I would not read more into the coalition yet. It has no named members on its site and no spec of its own. Its value depends on what it takes to the IETF and who shows up.
The Unique tier deserves the most care. It is the one that needs a third party to vouch that a person is unique, and it carries the highest privacy cost. Most routes should never need it.
What to do
- Product and security teams: Map each sensitive route to the lowest tier that solves its abuse problem, and write the decision down.
- CIAM teams: The Account tier is what you already provide through OAuth grants. Make sure agent grants are distinguishable from the customer's own session.
- Privacy teams: Track MOLE and Privacy Pass as ways to rate-limit agents without identifying users.
- Further reading: human principal, agent traffic detection, and the bot defense guide.