Cloudflare OS: An Open Platform That Gives Every Employee a Governed AI Agent

An Open Platform Where Every Worker Gets an AI Agent Built Around Company Context

Cloudflare today open-sourced Cloudflare OS — a fully deployable platform that gives every person inside an organization an agent workspace shaped by the company’s own terminology, procedures, and systems.

The release, detailed on the Cloudflare blog, transforms months of internal use across thousands of employees into a reusable blueprint that any enterprise can deploy in its own Cloudflare account and customize without touching core code.

Inside Cloudflare OS: Agent Workspaces, Gatekeepers, and App Blueprints

Cloudflare OS is built on three interlocking layers that move beyond simple chat toward machines that can execute.

Cloudflare OS combines three parts: an agent workspace grounded in context and skills your company curates, with an isolated runtime where agents can write and run code; a new security and governance framework for safe access to internal data and services; a platform for personal, modifiable apps that people can build, share, and continue changing.

What begins as a conversation can quickly evolve into a document, a presentation, or a live app with shared state and real-time collaboration.

Agent workspaces that write code, not just words

Each workspace runs entirely in the browser and ships with an isolated runtime where an agent can compose and execute TypeScript.

Because the workspace inherits a curated library of skills and institutional context, no employee needs to restate the same terminology or process at the start of every task.

Agents can query internal systems, analyze datasets with code instead of pulling everything into a model’s context window, and produce outputs — documents, spreadsheets, slides — that stay connected to live data sources.

Deterministic, repeatable jobs become workflows that use the model only at judgment points, saving tokens and cost while still automating the predictable steps.

A new security model: zero-access by default and Gatekeepers

Every agent and every app starts with access to nothing.

When an agent needs a specific resource, it must ask; the credential itself stays completely isolated from the agent and any generated code, arriving only as a typed capability in the server runtime.

Cloudflare Access controls who enters the platform, while Gatekeepers — service-specific Workers — sit between Cloudflare OS and external systems, holding OAuth tokens and enforcing fine-grained policy per resource, operation, and user.

A Gatekeeper can limit an agent to a single GitHub repository, allow reading issues but not source code, mask fields, or require approval before a pull request merges.

Server code runs inside a Dynamic Worker with global outbound networking disabled, and client code is sandboxed in the browser, ensuring neither can reach the internet except through explicitly granted capabilities.

Apps as first-class citizens with blueprints

Every “file” in Cloudflare OS can be its own full-stack application, not just a static artifact.

The agent writes client code for the UI and server code that stores state inside a Durable Object Facet with its own SQLite database, creating a complete, deployable app without any separate pipeline.

Sharing can operate in two modes: real-time collaboration on the app itself, or handing over a blueprint that duplicating the code but starts with independent state, data, and credentials — letting receivers modify the app with AI instead of filing feature requests.

All inference runs through Cloudflare AI Gateway, giving administrators control over which models handle which tasks, attribution of spend to every person and workspace, and the ability to set budgets or rate limits per team.

Customizable deployment and partner delivery

As the Cloudflare announcement notes, the open-source release includes two repositories: the OS core and an example deployment that mirrors Cloudflare’s internal configuration.

Organizations consume the core without patching it, instead layering on custom UI, internal Gatekeepers, analytics, and deployment pipelines tailored to how their people actually work.

Cloudflare’s strategic partners Presidio and Happy Cog will help enterprises curate shared skills, connect internal systems, and build a branded version of Cloudflare OS that reflects their own operational identity.

Agent Governance at the Data Layer: Why Cloudflare OS Reshapes Enterprise AI Trust

The most consequential architectural choice in Cloudflare OS is the observation log and the policy that follows what an agent has seen.

Tool-level authorization — the typical MCP pattern — only controls which endpoints an agent can call.

Cloudflare OS records every resource an agent observes and attaches those observations permanently to the agent and its work, so sharing a live dashboard built from a sensitive data warehouse table won’t silently leak access to people who shouldn’t see the original data.

This data-lineage guardrail automatically prevents an agent from exporting sensitive information through apps, inviting collaborators, or making outbound requests when the platform’s policy detects a conflict.

The approach removes a critical human-risk vector: individual teams building agentic workflows no longer have to implement authorization correctness themselves.

For enterprises that have been delaying AI agent adoption because of security concerns around data propagation, the model represents a substantial reduction in audit and compliance overhead.

By embedding governance directly into the runtime — not as a checklist item after the fact — Cloudflare OS positions itself as a reference architecture for trusted agentic computing.

The open-source nature means security researchers and internal platform teams can inspect, extend, and harden the policy engine, accelerating the broader industry’s move toward auditable, resource-aware agent frameworks.

From Chat to Apps: The New Operating System for AI-Native Work

Cloudflare OS closes the gap between the conversational surface of an AI tool and the executable, composable software layer that organizations actually need to turn context into operational output.

It treats agents not as a productivity add-on but as a platform primitive — one that can create, share, and modify live applications inside a governed perimeter, all without requiring every colleague to become a software engineer.

The shift from static file output to blueprinted, re-modifiable apps means institutional knowledge no longer calcifies inside a shared documents folder; instead it becomes code that others can instantly fork, adapt, and republish using the same agent that built it.

As enterprises increasingly build internal AI capabilities, the infrastructure that runs those agents and the security model that scopes their access become the real differentiators — and the ones that Compound over time as context libraries grow.

For teams actively architecting AI-native workflows, the conditions under which agents can read data, combine it, and republish it are now as critical as the model’s reasoning accuracy.

Deploying platforms like Cloudflare OS on performant and resilient infrastructure ensures that agent-driven applications stay fast, secure, and governable at scale — the same principles that Andres SEO Expert applies when engineering cloud hosting environments and programmatic AI automation pipelines that turn data into living content systems.

Connect with Andres to explore how managed cloud hosting can underpin your agentic platform, or how AI automation can extend agentic logic into your content and SEO workflows, working hand-in-hand with the same governance rigor you demand.