Cloudflare is launching analytics and access controls today that let website owners identify visiting personal agents and decide which supported agents can use their sites. Owners can allow an individual agent, block it, or restrict it on pages carrying ads, while setting a broader policy for other agent traffic. The tools cover agents acting for people, including those comparing products, seeking support or attempting purchases.
In Security Analytics, the Bot Analysis chart gains a Personal Assistants category that teams can select to track agent requests over time. A Personal Assistants widget under Top statistics identifies visiting agents and counts the requests from each. Selecting one agent filters the other widgets to reveal requested paths, returned status codes and the networks behind its traffic, helping owners examine activity around product pages, checkout and errors.
The access settings let owners make exceptions for individual supported personal agents within their overall Agents policy. For example, a site can generally block agents on advertising pages while allowing a selected agent to access them. These controls extend the Agents policy introduced this summer; Search and Training policies retain their existing settings, and the expanded setting takes the name AI Crawler and Agent access policies.
Account-level identification depends on Account Abuse Protection, which remains in early access. For sites using that protection, an overview shows the personal agents operating across users and the number of accounts using them, while login and sign-up events identify whether an agent made the request and which agent it was. Fraud teams can also narrow account results using AI assistant events or the number of AI assistants associated with them.
Within an individual account, analysts can inspect its associated agents and distinguish an established agent from one appearing for the first time. If an attacker appears to be operating through an agent, analysts can target that account with a WAF rule using its Hashed User ID, leaving other users of the agent unaffected. Cloudflare also offers access-policy choices during setup of a new zone, with recommendations based on whether the site earns money from advertising.
Recognizing an agent still does not necessarily tell a site whether its user is a customer or subscriber, or what actions that person authorized. Cloudflare says its next objective is to preserve that user context through agents, alongside ways to assess reputation and assign accountability when problems occur.
