Cloudflare spent a week describing what the internet looks like once AI agents are first-class visitors, not scrapers to be blocked. A browser built just for agents. Temporary accounts an agent can spin up with no signup. An access model that scopes what an agent may do. Web Bot Auth so an agent can prove it is a real, identified bot. A leaner MCP that runs statelessly on the edge. It is a serious body of work, it leans hard on open standards, and most of it is right.
Read the posts back to back, though, and the same sentence keeps almost getting said. Cloudflare's own Agent Access Model puts it plainly: every action an agent takes should be attributable to the human who initiated it, and an agent should only ever do what that human is allowed to do. That is the whole game. And it is the one part the plumbing keeps leaving for someone else to hold.
The line Cloudflare keeps stopping at
Look at where each piece ends, in Cloudflare's own words.
The Agent Access Model issues short-lived, task-scoped credentials and enforces policy at a mediation layer. Two of its own admissions matter here. First, in their words, "authoritative enforcement evidence cannot depend solely on model self-report," because an attacker can shape the model's account through the same inputs that shape its actions. Second, on delegation across agents: they are "not comfortable saying that multiplayer access control can be built end to end today." What the model as described does not include is cryptographic per-action signing at the source, or a proof of the action that a third party can verify offline without calling back to the enforcement point. Real-time mediation is the design. A portable record that outlives the task is left open.
Temporary accounts let an agent run wrangler deploy --temporary and get a live Worker in seconds, no human signup, and it stays up for sixty minutes. Genuinely useful. The post is about the deploy flow, not identity, and that is the gap: the agent gets operational authority and a short-lived token, with no persistent, verifiable identity behind it that a counterparty could check later.
Web Bot Auth lets an agent prove it is a known bot at the door, with an RFC 9421 signed request. It answers who is knocking. It does not, on its own, answer what the agent did once it was let in, or whether it was allowed to.
MCP v2 makes MCP servers stateless so they scale on Workers, and tightens authorization with pre-registered clients and audience-bound tokens. That authorization is client-to-server. It is not per-tool permissions inside a server, the spec deprecated the Logging capability rather than turning tool calls into an audit trail, and it says nothing about signing a tool-call result. Those are the pieces an accountable tool call needs, and they sit above the transport.
None of that is a criticism. Cloudflare is deliberately shipping the roads and the gate, not the whole stack, and leaving room for others on top. But the missing piece is always the same one: a persistent, portable, cryptographic answer to which agent, acting for which human, did what, and was it authorized. That is the accountability layer, and it is exactly what Vorim is.
What Vorim already does, that this week asks for
We did not build for Agents Week. We have been building this layer for a while, and the week mostly validated it. The mapping is close to one to one.
| Cloudflare shipped | The part it leaves open | What Vorim brings |
|---|---|---|
| Agent Access Model | source-signing, offline proof, multi-hop authority | Per-event signing at the source, offline-verifiable bundles, attenuated delegation that only ever narrows |
| Temporary accounts | short-lived token, no persistent identity behind it | Ephemeral agents with a real W3C did:key identity, a TTL, and a signed audit trail while they live |
| Web Bot Auth | who is knocking, not what they did | The same Ed25519 identity, plus a live trust score and a signed record of the action |
| MCP v2 (stateless) | no per-tool permissions, no signed tool calls | An MCP server whose tools are scope-gated per API key and log an audit event for every action, with tamper-evident signing done client-side through the SDK |
| x402, wallets | who paid, was it allowed | Agent-payment integrations that authorize the agent and sign the payment lifecycle |
| Markdown for agents | machine-readable content | An AGENTS.md and llms.txt so an assistant can wire trust in without a human reading the docs |
The through-line is that Cloudflare is building the roads, the tolls, and the ID check at the gate. Vorim is the notarized, portable record of who drove where and on whose authority, that holds up after the fact and without asking Cloudflare, or us, to vouch for it.
Two integrations we shipped this week
Talk is cheap, so here is code.
Web Bot Auth, from a Vorim identity. Your agent already has an Ed25519 identity in Vorim. One call turns it into the RFC 9421 headers a publisher checks, so the same identity that proves who is knocking is the one that carries a trust score and signs what it does next.
import { signRequestForBot } from '@vorim/sdk/integrations/web-bot-auth';
const headers = await signRequestForBot({
method: 'GET',
url: 'https://publisher.example/article',
privateKey: env.AGENT_PRIVATE_KEY,
signatureAgent: 'https://vorim.ai/agents/agid_abc123',
});
// Signature-Input / Signature / Signature-Agent, per RFC 9421
const res = await fetch('https://publisher.example/article', { headers });A guard for browsing agents on Cloudflare Workers. Cloudflare's agent browser makes each page load cheap. This wraps a browsing action so it is permission-checked before it runs, then emits an audit event that names the agent and the human it acts for, and returns a receipt. Load the agent's key into the Worker (keep it in a Worker secret) and that event is signed at the source with Ed25519, so it verifies offline with no call back to Cloudflare or to us. It runs on Workers natively, because the SDK signs with Web Crypto and needs no Node.
import createVorim from '@vorim/sdk';
import { createVorimCloudflare } from '@vorim/sdk/integrations/cloudflare';
const vorim = createVorim({ apiKey: env.VORIM_API_KEY });
vorim.useAgentKey('agid_browse_bot', env.AGENT_PRIVATE_KEY); // sign at the source
const guard = createVorimCloudflare(vorim, {
agentId: 'agid_browse_bot',
humanId: 'user_jane',
scope: 'agent:read',
});
const { receipt, value } = await guard.browse(
{ url: 'https://example.com', action: 'html_extract' },
() => fetch('https://browser.cloudflare.com/...'),
);Both are in the SDK today, and both run on the edge, so they slot into the exact runtime Cloudflare is pushing agents toward.
Why this is the right split
We are not going to build a browser. Cloudflare's edge is the moat there, and competing on compute would be a bad use of anyone's time. What the agentic web will need, and what no amount of cheaper browsing or faster payment rails provides on its own, is a record that outlives the task and does not depend on any one vendor to be believed. A regulator, an auditor, or a counterparty has to be able to check it themselves.
Cloudflare is building the internet agents will live on. We are building the part that lets you trust what they did on it. Those fit together, and this week they got a lot closer.
Want to wire it in? Start with the <a href="/documentation/quickstart">quickstart</a>, or see the <a href="/documentation/protocols">Cloudflare and Web Bot Auth integrations</a>. Questions, we read every email at <strong>team@vorim.ai</strong>.
Ready to build with AI agents?
See how Vorim gives your agents identity, permissions, and a signed audit trail. Book a walkthrough with our team.