SOURCE

The Agent Access Model

Properties1
tagscloudflare, agent-security, least-privilege, primary-source

2 min read

The Agent Access Model

Summary

Cloudflare’s Agent Access Model (AAM) argues that human and service-account security controls do not fit short-lived, machine-speed agent runs. Prompts express intent but cannot enforce boundaries; credentials often outlive tasks; agents compose authority across tools and subagents; and human-speed anomaly detection can react after data has already moved. AAM’s core rule is to authorize each action against the agent, its declared task, and the policy-relevant resources already touched.

The model has five principles: short-lived task-bound credentials; enforcement in the harness and network rather than the prompt; exceptional rather than constant human approval; grant review based on external evidence; and a one-way “Trust Ratchet” that can remove capabilities during a run but cannot restore them. The reference architecture combines an identity broker, task-scoped access engine, harness/network mediation, Trust Ratchet, append-only activity log, and review loop for future task templates. It emphasizes typed outputs and fixed recipients over generic network or messaging tools.

For client automation, the immediate lesson is to start with one bounded, single-principal workflow and technically constrain what it can read, write, and contact. Mystery-shopper browsing can often remain read-only. Appointment requests, client-site changes, publishing, and external messages should use narrow tools, fixed schemas, and selective approvals. The paper explicitly warns that approving every step creates fatigue rather than safety. It also says multi-user agents with different permissions remain an unsolved end-to-end problem; shared client work should isolate per principal or use a conservative common grant instead of assuming the model will preserve data provenance.

Key Claims

  • Task credentials should be short-lived, scoped, sender-constrained, and attributable.
  • Tool and network enforcement must sit outside the model and fail closed.
  • Capability can narrow during a task but should require a fresh task to widen.
  • Activity evidence should refine future templates, never widen an active run.
  • Multi-principal authorization through retrieval, generation, caching, and delivery is not solved end to end.

Connections

Contradictions

  • Refines the roundup’s human-in-the-loop framing: constant approval is an anti-pattern; bounded authority and selective approval are the intended control model.