Cloudflare put its internal AI workspace on GitHub this week and called it Cloudflare OS. The company had been running the thing on itself since May, when it handed a first version to every employee. By August, thousands of people across sales, finance, IT and engineering were using it daily to draft documents, build slide decks, automate repetitive jobs and throw together small internal apps. The rebuilt version is now a repository anyone can clone, plus a managed option promised through the Cloudflare dashboard later and a partner program for companies that want someone else to do the wiring.
The press release framing is the boring part. Every large vendor now has an enterprise agent story, and most of them sound identical: your employees are already pasting company data into consumer chatbots, our version is safe, please sign here. What separates this launch is where Cloudflare put the engineering effort.
The credential layer is the product
The workspace itself is unremarkable in outline. A browser chat window, grounded in whatever context and procedures the company has curated, with a sandboxed runtime so the agent can write and run code rather than reasoning its way through problems in prose. Cloudflare calls the small apps that come out of it Gadgets, and each one runs as its own isolated Worker instead of shared multi-tenant code.
The interesting piece sits underneath, and Cloudflare named it Gatekeepers.
The problem Gatekeepers solve is the one every company hits about three weeks into an AI rollout. People want the agent connected to Salesforce, GitHub, the data warehouse, the ticketing system. The fast way to do that is to issue API keys. API keys are broad, long-lived, hard to scope and nearly impossible to audit after the fact. MCP improves on this by holding the credential server-side and exposing a defined tool list, but a tool list only tells you what an agent is permitted to call. It says nothing about what the agent actually saw.
A Gatekeeper is a service-specific Worker that sits between the agent and the external system. It understands that service’s API well enough to narrow access below the level the API itself supports: one repository rather than a whole GitHub account, issues but not source code, fields masked, write actions held for human sign-off. The credential never reaches the agent or the code it wrote. Agents start with permission to nothing and receive capabilities for the specific task in front of them, and neither the agent nor the apps it builds can reach the open internet except through capabilities explicitly granted.
Then it goes a step further. Every observation gets logged, and the log constrains what happens next. An agent that has read sensitive data can be blocked from writing to particular destinations, from inviting new collaborators, from handing the job to another agent, or from making outbound requests at all. When a second person tries to open that workspace or view what the agent produced, their own access to the observed resources gets checked first.
That is taint tracking applied to a work session. It is the correct answer to prompt injection and data exfiltration in a way that instructing the model to behave is not, because it does not depend on the model behaving. Whether it holds up under adversarial pressure outside Cloudflare’s own building is an open question, but the design premise is right.
Open source as a distribution channel
Cloudflare is explicit that it does not particularly want companies running Cloudflare OS. It wants them to fork it and make it their own. That sounds generous until you notice what the fork runs on.
Every Gadget is a Worker. Every Gatekeeper is a Worker. The apps ride on Dynamic Workers and Durable Object facets built for this project, talking to clients over Cap’n Web, Cloudflare’s capability-based RPC system. Access handles authentication. AI Gateway handles model routing, per-person and per-team spend visibility, budgets, rate limits and downgrading routine work to cheaper models. Self-hosting Cloudflare OS means self-hosting it on Cloudflare.
So the client is free and the substrate is metered. This is a consumption play dressed as a governance play, and it is a good one, because governance is where Microsoft and Google are weakest and where enterprise buyers are most nervous.
The model vendors should read it differently. Bring-your-own-model with granular cost attribution and automatic routing to smaller models treats the LLM as a swappable input purchased on price. Anyone whose enterprise strategy depends on owning the workspace rather than the weights just watched a large distribution network argue that the workspace should be commodity infrastructure the customer owns outright.
What could go wrong
Kenton Varda, who designed this, built capability-based personal application hosting once before and it did not find a market. His own account of why is worth taking seriously: the model was sound, but ordinary people could not write the applications. What changed is not the security architecture. It is that the agent now writes the app.
The harder practical problem is that Gatekeepers do not write themselves. Each one is bespoke software encoding what a specific service permits and what your company wants permitted inside it. A company with forty systems of record has forty of those to build and maintain, which is precisely the integration work that made every previous enterprise platform slower to deploy than the demo suggested. Hence the implementation partners.
The rest is unknowable for now. Nobody has run this at scale in an organization that was not Cloudflare, with Cloudflare’s engineering culture and Cloudflare’s tolerance for internal tooling that breaks.
Still, of the enterprise agent launches this year, this is the first one whose security model would survive contact with a competent skeptic.