Cloudflare Open-Sources Cloudflare OS, Putting AI-Built Work Apps Behind Permission Gates
The enterprise platform’s central wager is that employees can customize software safely when every app instance is isolated and every connection is explicitly scoped.
Listen to this story
The audio brief
Story brief
3 key pointsCloudflare is releasing an operating layer for AI-generated internal tools that treats each user or document copy as an isolated Gadget rather than a shared application. Its Gatekeepers system gives agents no default access, can mask database fields, throttle usage, and require approval for destructive actions. Cloudflare reports more than 4,000 tools built internally in 30 days, 10,000 hours of sales work recovered, and nearly 250,000 potential bugs flagged.
- 01
Gatekeepers begins agents with zero ambient permissions and grants access only through explicit capabilities.
- 02
Shared Gadgets require recipients to hold direct permission for every attached resource, limiting damage from application bugs.
- 03
Cloudflare says internal employees built 4,000-plus tools in 30 days and recovered 10,000 sales hours.
Cloudflare has released Cloudflare OS as open-source software under the Apache-2.0 license. The platform lets enterprise teams create AI-assisted work artifacts and workflows from company knowledge and provisioned connectors, while placing each user’s application in a separate sandbox.
Cloudflare OS does not treat a generated tool as one centrally shared application. It creates sandboxed instances called Gadgets for users and documents. A user can ask generative AI to change the source code of that individual instance, making personal customization possible without altering a shared copy.
One copy, one boundary
Those instances run in V8 isolates managed through Cloudflare’s open-source workerd runtime and Dynamic Workers. Cloudflare says a person receiving a shared Gadget must independently have direct permission for every resource attached to it. The sharing check is intended to prevent an app’s own bug from granting access beyond a recipient’s existing rights.
Permissions start at zero
The control layer, called Gatekeepers, uses capability-based security: a capability is a specific permission to use a resource. Cloudflare says agents begin with zero ambient permissions, so they do not automatically inherit broad access. The company contrasts that design with standard MCP connection implementations that often provide ambient, broad access to systems and resources.
What Gatekeepers can restrict
- Access can be limited to designated resources.
- Sensitive database columns can be masked, and rate limits can vary by role.
- Destructive actions can require human approval before execution.
Cloudflare reported that non-technical employees built more than 4,000 custom business tools within 30 days.
Cloudflare estimated that sales teams recovered 10,000 hours of manual data-aggregation work using the platform.
Cloudflare said automated engineering review agents flagged nearly 250,000 potential bugs.
An internal response to custom-tool demand
Cloudflare employees have used the platform since May 2026. The project grew from internal demand for generative-AI workflows that could otherwise seek elevated administrative access and production API tokens across company systems. Cloudflare said its review agents also blocked 16,000 non-compliant merges and identified roughly 600 architectural defects before implementation.
The challenge beyond Cloudflare
Lead architect Kenton Varda argues the product merits the operating-system label because it manages compute, isolates processes, and enforces capability boundaries for non-technical software authors. One developer-community commenter praised the capability model but questioned whether standalone workspaces can compete with tighter integrations from established productivity suites. Cloudflare also provides a starter deployment template alongside the release.
Editorial analysis
Our Read
Our view: Cloudflare OS treats internal AI software less like a shared chatbot and more like a fleet of small, separately governed applications. That is a meaningful architectural bet as agents gain access to company systems. The practical test is not whether employees can produce tools; Cloudflare’s internal figures suggest they can. It is whether Gatekeepers remain understandable enough for teams to configure correctly while still allowing useful connections. Watch for deployments beyond Cloudflare that show how organizations handle sharing, approvals, and connector access at scale.
Sources
- infoq.comCloudflare OS: Cloudflare
Reader comments
Newest comments first. Replies stay oldest first.