AI Safety
Cloudflare's WriteGuard Brings Granular Access Controls for AI Agents Over MCP
New security layer lets teams enforce what actions AI agents can take when connected to external systems, rather than blocking write access entirely.
InfoQ
Cloudflare is rolling out WriteGuard, a fresh security framework designed to give teams fine-grained control over what AI agents can do when they interact with external tools and services. The service, now in private beta, sits between an AI application and the systems it connects to—managing and auditing every write action the agent attempts.
The Problem: From Read-Only to Safe Writes#
For a time, restricting AI agents to read-only access was the safe choice. But as teams grew more confident with AI and expanded use cases across engineering, product, and support functions, the demand grew for agents that could actually do things—not just inspect them. The challenge became clear: how to let agents take action while preventing costly or dangerous mistakes?
WriteGuard addresses this by creating a centralized policy layer that can say yes, no, or maybe to each request an agent makes. According to Cloudflare engineers, the alternative—baking security controls into each individual MCP server—would mean rewriting the same rules over and over across GitHub, Jira, Google Workspace, wikis, and internal APIs.
How It Works#
The system intercepts all incoming Model Context Protocol (MCP) requests at the Cloudflare portal and evaluates them against assigned policies. Every tool gets tagged with a risk tier:
- Read-only: no risk, purely informational
- Minimal impact: actions like adding a comment, marking notifications as read
- Contained write: higher-stakes changes such as creating a merge request or updating issue fields
- Critical: destructive or production-affecting moves like completing merges, triggering deployments, or bulk deletes
When a request comes in, WriteGuard checks the policy for that tool and context, then either lets it through, blocks it, or—if approved but it fails—logs the failure for investigation.
Auditing Without Extra Accounts#
A key design choice: WriteGuard doesn't require standalone agent accounts. Instead, it leverages existing OAuth credentials to identify the human behind the request, then adds MCP client and session metadata to make agent-driven actions fully traceable. Every invocation gets classified as successful, failed, or blocked and sent to an internal audit log—with sensitive values scrubbed beforehand.
