Trusted Agent Delegation
Trusted Agent Delegation (TAD).
Trusted Agent Delegation (TAD) is a coalition announced by Cloudflare in November 2026 to work on how websites recognize, serve and hold accountable a user acting through an AI agent, with four tiers of user identification.
The four tiers are the useful part of TAD for anyone designing customer identity. They turn a vague question, "do we need to know who this agent's user is?", into a choice with a privacy cost attached. A content site may need only Nothing or Session. A store with saved carts needs Account. A site fighting multi-accounting or giveaway abuse may want Unique, which is where proof-of-human identifiers come in.
The Account tier is what CIAM already does: an OAuth grant tied to a customer account, as in the Personal Agent Protocol. The tiers below it are where privacy-preserving tools such as MOLE fit, letting a site rate-limit an agent without learning who sent it. Sources: Cloudflare, "Agents aren't humans (but they kinda are)" and the coalition site.
Our reading. Treat the tiers as a data-minimization checklist for agent traffic. Pick the lowest tier per route, not per site, and write the choice down; that record is what a regulator or a partner will ask for. Detection still matters for agents that bring no identifier at all; see agent traffic detection.
Common questions
What is Trusted Agent Delegation?
Trusted Agent Delegation (TAD) is a coalition Cloudflare announced on November 5, 2026. It brings agent operators, identity verifiers, payment providers, merchants and publishers together to work out how a site can recognize and hold accountable a user who acts through an AI agent. It is a coalition that plans to take problems to the IETF, not a finished standard.
What are the four TAD user-identification tiers?
Nothing: the user brings no identifier. Session: the site can link requests in one session to a single agent. Account: the site can attribute requests to the same user across sessions. Unique: the site gets a unique, per-user identifier provisioned by a third party. Each tier reveals more about the user, so a site should ask for the lowest tier that solves its problem.
Who is in the Trusted Agent Delegation coalition?
Cloudflare's announcement and the trustedagentdelegation.org site describe the kinds of participants (operators, identity verification companies, payment providers, merchants, publishers, proxy and cloud browsing companies) but do not list named members. Check the coalition site for a member list before citing one.
How does TAD relate to Personal Agent Protocol and MOLE?
Cloudflare's post points to existing work rather than replacing it. It cites the Personal Agent Protocol's session concept, Web Bot Auth for agent signatures, and MOLE and Privacy Pass for privacy-preserving rate limiting. TAD is the forum; those are candidate building blocks.
Related terms
In the guides
Authentication for AI Agents: OAuth Patterns for Non-Human Identity
How AI agents authenticate in 2026. The on-behalf-of pattern, delegated agent identity, OAuth 2.1 Dynamic Client Registration, and where the patterns are still being invented.
Bot Defense and Fraud Detection for Authentication Endpoints
Credential-stuffing bots, account-creation bots, scrapers, MFA-fatigue bots: the modern auth endpoint faces continuous automated attack. The defenses that hold and the ones that don't.
Know Your Agent: Identity for AI Agents That Buy on a Customer's Behalf
What a CIAM team must build when a customer's AI agent shows up at login, account, or checkout: delegated consent, agent sessions, step-up, audit, and revocation.