Superpower Daily
Cloudflare Open-Sources Cloudflare OS, Putting AI-Built Work Ap...Perplexity’s Agent API Adds Managed Connectors for GitHub Code...China’s $226M Underwater Data Center Is Running. The Ocean Stil...Mexico and AMD Sign AI Talent Pact Tied to Coatlicue Supercompu...MiniMax H3 Opens Its Video Weights, but Not Where Many Develope...Higgsfield Puts Its Video Engine Behind Grok Bot—and Keeps the...Cloudflare Open-Sources Cloudflare OS, Putting AI-Built Work Ap...Perplexity’s Agent API Adds Managed Connectors for GitHub Code...China’s $226M Underwater Data Center Is Running. The Ocean Stil...Mexico and AMD Sign AI Talent Pact Tied to Coatlicue Supercompu...MiniMax H3 Opens Its Video Weights, but Not Where Many Develope...Higgsfield Puts Its Video Engine Behind Grok Bot—and Keeps the...
Toolspublished

Cloudflare Open-Sources Cloudflare OS, Putting AI-Built Work Apps Behind Permission Gates

The enterprise platform’s central wager is that employees can customize software safely when every app instance is isolated and every connection is explicitly scoped.

By 3 min read
Cloudflare Open-Sources Cloudflare OS, Putting AI-Built Work Apps Behind Permission Gates
Sign in to save and react

Listen to this story

The audio brief

About 1:44
0:001:44
Read transcript
Cloudflare is open-sourcing Cloudflare OS, a platform for building AI-assisted work tools without making every tool a shared, all-access application. Instead, it creates isolated copies called Gadgets for individual users and documents. Each copy runs in a V8 isolate, managed through Cloudflare’s open-source workerd runtime and Dynamic Workers. That means a user can ask generative AI to modify their own Gadget without changing everyone else’s version. The security model is the bigger story. Cloudflare’s Gatekeepers system starts agents with zero ambient permissions. Access is granted only through explicit capabilities tied to specific resources. Shared Gadgets also require each recipient to already have direct permission for every attached resource, limiting the damage a buggy application could cause. Administrators can mask sensitive database columns, apply different rate limits, and require human approval for destructive actions. Cloudflare contrasts this with standard MCP connections, which can provide broader ambient access. The company says its employees built more than 4,000 custom tools in 30 days, recovering 10,000 hours of sales data-aggregation work. Review agents flagged nearly 250,000 potential bugs, blocked 16,000 non-compliant merges, and found about 600 architectural defects before implementation. Cloudflare calls this an operating system because it manages compute, isolation, and permissions. The open-source release, under Apache-2.0, includes a starter deployment template. The key constraint now is whether this tightly isolated model can match the integrations offered by established productivity suites.

Story brief

3 key points

Cloudflare is releasing an operating layer for AI-generated internal tools that treats each user or document copy as an isolated Gadget rather than a shared application. Its Gatekeepers system gives agents no default access, can mask database fields, throttle usage, and require approval for destructive actions. Cloudflare reports more than 4,000 tools built internally in 30 days, 10,000 hours of sales work...

  1. 01

    Gatekeepers begins agents with zero ambient permissions and grants access only through explicit capabilities.

  2. 02

    Shared Gadgets require recipients to hold direct permission for every attached resource, limiting damage from application bugs.

  3. 03

    Cloudflare says internal employees built 4,000-plus tools in 30 days and recovered 10,000 sales hours.

Cloudflare has released Cloudflare OS as open-source software under the Apache-2.0 license. The platform lets enterprise teams create AI-assisted work artifacts and workflows from company knowledge and provisioned connectors, while placing each user’s application in a separate sandbox.

Cloudflare OS does not treat a generated tool as one centrally shared application. It creates sandboxed instances called Gadgets for users and documents. A user can ask generative AI to change the source code of that individual instance, making personal customization possible without altering a shared copy.

One copy, one boundary

Those instances run in V8 isolates managed through Cloudflare’s open-source workerd runtime and Dynamic Workers. Cloudflare says a person receiving a shared Gadget must independently have direct permission for every resource attached to it. The sharing check is intended to prevent an app’s own bug from granting access beyond a recipient’s existing rights.

Permissions start at zero

The control layer, called Gatekeepers, uses capability-based security: a capability is a specific permission to use a resource. Cloudflare says agents begin with zero ambient permissions, so they do not automatically inherit broad access. The company contrasts that design with standard MCP connection implementations that often provide ambient, broad access to systems and resources.

What Gatekeepers can restrict

  • Access can be limited to designated resources.
  • Sensitive database columns can be masked, and rate limits can vary by role.
  • Destructive actions can require human approval before execution.
Cloudflare’s internal use, by its account
More than 4,000Custom business tools

Cloudflare reported that non-technical employees built more than 4,000 custom business tools within 30 days.

10,000 hoursSales work recovered

Cloudflare estimated that sales teams recovered 10,000 hours of manual data-aggregation work using the platform.

Nearly 250,000Potential bugs flagged

Cloudflare said automated engineering review agents flagged nearly 250,000 potential bugs.

An internal response to custom-tool demand

Cloudflare employees have used the platform since May 2026. The project grew from internal demand for generative-AI workflows that could otherwise seek elevated administrative access and production API tokens across company systems. Cloudflare said its review agents also blocked 16,000 non-compliant merges and identified roughly 600 architectural defects before implementation.

The challenge beyond Cloudflare

Lead architect Kenton Varda argues the product merits the operating-system label because it manages compute, isolates processes, and enforces capability boundaries for non-technical software authors. One developer-community commenter praised the capability model but questioned whether standalone workspaces can compete with tighter integrations from established productivity suites. Cloudflare also provides a starter deployment template alongside the release.

Editorial analysis

Our Read

Our view: Cloudflare OS treats internal AI software less like a shared chatbot and more like a fleet of small, separately governed applications. That is a meaningful architectural bet as agents gain access to company systems. The practical test is not whether employees can produce tools; Cloudflare’s internal figures suggest they can. It is whether Gatekeepers remain understandable enough for teams to configure correctly while still allowing useful connections. Watch for deployments beyond Cloudflare that show how organizations handle sharing, approvals, and connector access at scale.

Related coveragePerplexity’s Agent API Adds Managed Connectors for GitHub Code and PR Workflows

Sources

  1. infoq.comCloudflare OS: Cloudflare

Related coverage

Continue reading