网络安全
Cloudflare 个人 Agent 分析和Per-Agent访问控制
在 Google 上的首选来源中添加 Unite.AI
2026年11月4日的Cloudflare 宣布是用于个人-agent活动的发布分析器和更多的颗粒式访问政策，给站点所有人一种识别agents为人行为的方法，并为每个支持的agent设定了不同的条件。
这些产品解决了网站的分类问题。 客户可能要求agent比较产品，找到支持物品，或完成一项购买，但所有三种相互作用都作为自动流量运抵。 企业不知道agent正在访问哪一个以及它在做什么，因此无法轻易区分有用的客户引导的活动和风险；封锁每个agent也可能意味着放弃客户。
个人- Agent 交通变得明显
安全分析师现在将个人助理列为瓶子分析类，与经验证的瓶子(可能是人、可能是自动和自动的)并列。 选择它会随着时间的推移将个人-agent流量隔离，将这些请求与更广泛的自动流量视图区分开来。
顶级统计名下的一个个人助理部件agents访问一个站点并计算每个人的要求。 过滤一个 agent 更新其他部件以显示其请求的路径、 接收状态代码和源网络。 由此产生的视图可以显示agent是否在登录，读取产品页面，达到校验，或者在其无法使用的页面中遇到错误。
使用账户滥用保护的站点目前处于早期访问状态，可接收另一个用户级的视图。 其人口概括了显示个人agents在用户中有哪些活动以及有多少账户使用。 登录和注册事件可以识别个人agent是否提出了请求，以及哪个请求，而欺诈小组可以通过AI-Asistance事件过滤账户或助理人数。
一个与该账户相关的个人账户概览新增 agents，允许分析师将使用周的agent与首次出现的agent区分开来。 如果活动暗示账户被滥用，分析师可以对该账户的Hashed用户ID应用网络应用防火墙规则，而不是为其他用户屏蔽agent.
基本的账户侵权保护仪表板是2026年10月2日的推出。 系统从登录或注册流程中获取客户配置的标识符，如电子邮件地址、用户名或电话号码，并加密地将其散装成一个保存隐私的每个域的Hashed用户ID，以锁定账户的活动历史。
Agent提供访问政策
Cloudflare正在扩展其现有的Agents政策，对支持的个人agents进行控制，并重新命名设置AI Crawler和Agent访问政策。 在安全设置中，一个站点可以建立总体的Agents政策，然后选择允许(不屏蔽)，在页面上用广告块块，或者每个支持的个人agent的块块。
这一结构允许例外，而不是只作出一项涉及每个agent的决定。 例如，一个网站可以一般在载有广告的页面上屏蔽agents，同时允许一个支持的个人agent. 现有的搜索和培训政策保持不变。
控制延长了2026年7月1日的AI交通政策Cloudflare 推出，它分离了Search,Agent，和训练行为。 Agent类涵盖自动化行为，通常以实时方式，代表一个人，包括聊天-fatch bots和浏览器-使用agents. 每个agent的新选择在这一类别内运作，而不改变单独的搜索或培训政策。
Cloudflare在新区登机时还询问一个网站是否将网页货币化，并配有广告和裁缝，为答案推荐政策。 在后来的安保设置中仍然可以使用这些控制，随着网站偏好的变化，可以重新讨论最初的建议。
Agent 身份离开用户上下文未解
Cloudflare 称的下一个目标是在个人agents担任中间人时，保留网站与用户关系的背景。 识别agent并不能确定背后的人是否是现有客户，被授权人采取了什么行动，订阅是否适用，或者应当适用何种保护。
其拟议的下一步工作涉及通过agent携带用户背景的隐私意识机制，帮助网站评估声誉，并在出错时建立明确的问责制。 Cloudflare计划在与agent运营商和其他生态系统参与者合作时，更多地分享网站能否在保持与用户关系的同时，给予agents更多的访问权限。
对站点所有者来说，agent访问成为具体的商业选择，而不是对自动化的一揽子反应。 更广泛访问的范围仍然与更严格的要求有关：当agent处于企业与用户之间时，维护客户关系。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Cloudflare Adds Personal Agent Analytics and Per-Agent Access Controls
Add Unite.AI to your preferred sources on Google
Cloudflare announced on November 4, 2026, that it is launching analytics for personal-agent activity and more granular access policies, giving site owners a way to identify agents acting for people and set different terms for each supported agent.
The products address a classification problem for websites. A customer may ask an agent to compare products, find support articles, or complete a purchase, but all three interactions arrive as automated traffic. Without knowing which agent is visiting and what it is doing, a business cannot easily distinguish useful customer-directed activity from risk; blocking every agent can also mean turning away customers.
Personal-Agent Traffic Becomes Visible
Security Analytics now lists Personal Assistants as a Bot Analysis category alongside Verified Bot, Likely Human, Likely Automated, and Automated. Selecting it isolates personal-agent traffic over time, separating these requests from the broader automated-traffic view.
A Personal Assistants widget in Top Statistics names the agents visiting a site and counts each one’s requests. Filtering for one agent updates the other widgets to show its requested paths, received status codes, and originating networks. The resulting view can show whether an agent is logging in, reading product pages, reaching checkout, or encountering errors on pages it cannot use.
Sites using Account Abuse Protection, currently in early access, receive a further user-level view. Its population overview shows which personal agents are active across users and how many accounts use them. Login and sign-up events identify whether a personal agent made the request and which one, while fraud teams can filter accounts by AI-assistant events or the number of assistants.
An individual account overview adds the agents associated with that account, allowing an analyst to distinguish an agent with weeks of use from one appearing for the first time. If activity suggests account misuse, the analyst can apply a web application firewall rule to that account’s Hashed User ID rather than block the agent for every other user.
The underlying Account Abuse Protection dashboard was introduced on October 2, 2026. The system takes a customer-configured identifier from a login or sign-up flow, such as an email address, username, or phone number, and cryptographically hashes it into a privacy-preserving, per-domain Hashed User ID that anchors the account’s activity history.
Access Policies Can Vary by Agent
Cloudflare is expanding its existing Agents policy with controls for supported personal agents and renaming the setting AI Crawler and Agent access policies. In Security Settings, a site can establish an overall Agents policy and then choose Allow (do not block), Block on pages with ads, or Block for each supported personal agent.
That structure permits exceptions instead of a single decision covering every agent. For example, a site can block agents generally on pages carrying ads while allowing one supported personal agent. Existing Search and Training policies remain unchanged.
The controls extend the AI traffic policies Cloudflare introduced on July 1, 2026, which separated Search, Agent, and Training behaviors. The Agent category covers automation acting, usually in real time, on a person’s behalf, including chat-fetch bots and browser-use agents. The new per-agent choices operate within that category without changing the separate search or training policies.
Cloudflare also asks during new-zone onboarding whether a site monetizes pages with ads and tailors recommended policies to the answer. The controls remain available later in Security Settings, allowing the initial recommendations to be revisited as a site’s preferences change.
Agent Identity Leaves User Context Unresolved
Cloudflare said its next goal is to preserve the context of a site’s relationship with users when personal agents act as intermediaries. Identifying an agent does not establish whether the person behind it is an existing customer, what actions the person authorized, whether a subscription applies, or which protections should apply.
Its proposed next work involves privacy-aware mechanisms for carrying user context through an agent, helping sites assess reputation, and establishing clear accountability when something goes wrong. Cloudflare plans to share more as it works with agent operators and other ecosystem participants on whether sites can grant agents greater access while maintaining relationships with their users.
For site owners, agent access becomes a concrete business choice rather than a blanket response to automation. The scope for broader access remains tied to a harder requirement: preserving customer relationships when an agent sits between the business and the user.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.