Cloudflare Introduces WriteGuard to Govern AI Agent Actions on Internal Servers

Cloudflare has introduced WriteGuard, a novel control layer designed to govern the actions of AI agents interacting with its internal Model Context Protocol (MCP) servers. This new system aims to provide fine-grained controls, centralized policy enforcement, and detailed attribution for AI agent operations, thereby mitigating risks associated with accidental or malicious data modifications. The development comes as AI agents become increasingly integrated into internal workflows, necessitating robust security measures beyond basic access controls.

The need for WriteGuard was highlighted by a hypothetical scenario involving an AI agent erroneously closing thousands of support tickets. This incident, while illustrative, underscores the potential for even well-intentioned AI tools to cause significant disruption if their prompts are too broad or their access is not adequately constrained. In such cases, distinguishing between human and agent actions within system logs can be challenging, complicating incident response and state restoration. WriteGuard seeks to address this by providing clear audit trails and attribution.

MCP, or Model Context Protocol, is a standard framework that enables AI applications to connect with external tools and data sources. MCP servers expose a set of tools, each with a defined name, description, input schema, and handler. AI agents utilize these tools by making calls to the MCP server, which then orchestrates the interaction with the underlying applications. Cloudflare relies heavily on MCP for its internal AI agents, which operate through various local clients and long-running services, all managed via a centralized MCP server portal.

Initially, Cloudflare's MCP servers were configured for read-only access, allowing employees to query data without making changes. However, as AI capabilities advanced and teams gained more experience, there was a growing demand for tools that could perform actions, such as modifying data or updating records. This shift necessitated the development of WriteGuard to ensure that these write actions could be controlled centrally, attributed to specific agents, and easily audited, without relying on less reliable client-side controls like prompts or skills.

WriteGuard functions as a shared policy, attribution, and auditing layer. It analyzes tool configurations and request contexts to determine whether to allow an action, enrich it with agent attribution, or block it entirely. The system assigns a risk tier to each tool, dictating logging and access permissions, and supports labeling to embed agent attribution information directly into downstream applications. This configuration, currently managed in TypeScript, will soon be available through Cloudflare's MCP server portals in a private beta.

Cloudflare has maintained its existing model of using human identity for agent permissions, meaning an agent operates with the same privileges as the logged-in user. This approach avoids the complexity of managing separate agent accounts and keeps a clear line of responsibility. WriteGuard enhances this by adding MCP client and session context to the human identity, clearly identifying each write action as originating from a specific agent session acting on behalf of a particular person. This detailed attribution is valuable not only for incident response but also for understanding and interpreting changes made by AI agents.

The system's auditing capabilities are designed to provide a fleet-wide view of machine-speed activity. By logging and making queryable the actions performed by agents, WriteGuard enables security teams to monitor for anomalous behavior, investigate incidents, and ensure compliance. This comprehensive approach to governing AI agent interactions is crucial for maintaining the integrity and security of internal systems as AI adoption continues to accelerate within organizations.