Cloudflare’s bot management UI now presents an "AI Crawler and Agent access policies" screen where the top Personal Agents can be configured individually. The change replaces the previous generic "Configure AI bot policies" setting and adds the ability to assign separate actions per agent while preserving the existing Agents policy as a default.
What Changed in the Policy UI
The configuration path is now Security > Settings > AI Crawler and Agent access policies. Within the dialog, each of the leading Personal Agents appears with its own toggle, allowing you to choose between the same actions available for generic bots (allow, block, challenge, etc.). By default, Personal Agents inherit the broader Agents policy, and Cloudflare’s guidance recommends keeping this inheritance set to Allow unless a specific use case demands restriction.
Operational Impact for Engineers
Teams responsible for site availability and performance should audit the new per‑agent settings after the UI rollout. Because the default remains permissive, existing traffic will not be disrupted, but any intentional tightening of access must be applied to each agent explicitly. The UI change also means that automation scripts or IaC templates that previously referenced the old setting name will need to be updated to the new AI Crawler and Agent access policies identifier.
Security Considerations
Granular control reduces the attack surface presented by automated agents that act on behalf of users. By limiting a Personal Agent that is not required for a particular workflow, you can prevent it from crawling sensitive pages or extracting proprietary content. Conversely, an overly restrictive configuration could break legitimate use cases such as product comparison tools that rely on these agents. Monitoring the policy logs for unexpected agent activity becomes more valuable now that each agent can be distinguished.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Review the default inheritance and decide whether the recommended Allow stance aligns with your risk model. If you need tighter control, use the new per‑agent toggles to apply the appropriate action for each Personal Agent. Update any deployment scripts to reference the renamed setting, and add a periodic check to ensure the policy state matches your security baseline.
