Agents inherit the employee's identity instead of getting their own accounts: if Joe cannot close an issue, Joe's AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → cannot either. That avoids a second permission set, at the cost that downstream systems see only Joe — so the layer injects agent session context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition →.
Client-side guardrailsThe checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.Full definition → were rejected on principle. Skills and elicitation prompts behave differently in every agent harnessThe scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.Full definition → and users can switch them off, so policy has to sit in front of the tool handler where it cannot be disabled.
The policy unit is the individual tool, not the server: each gets a risk tier and an on/off switch. Read-only calls pass through untouched, contained writes get attribution plus an audit event, and critical tools are blocked before their handler ever runs.
Which tools are critical follows blast radius, not obviousness — merging a request is blocked because at Cloudflare a merge triggers a deploy pipeline. The same tool would be routine somewhere without that wiring.
Audit events are written asynchronously and scrubbed of values under secret or sensitive keys, so logging adds zero latency to the call the agent is waiting on while still recording server, tool, risk tier, outcome, user, client, and duration.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.
Why it matters
Anyone giving agents write access through MCP faces the same attribution and blast-radius problem this describes, and now has a named control model for it.
Key quotes
“The system records all those changes under Joe regardless of whether it was him or his agent, and the network logs do not distinguish one agent session from another.”
“At Cloudflare, we knew we could not depend on every employee to configure every agent perfectly or watch every tool call.”
“If Joe cannot close a particular issue, Joe’s agent cannot close it either.”
“Because an agent can repeat an action much faster than a person, we also needed central auditing across every MCP server.”
