SYSTEM Cited by 1 source

Cloudflare OS Gatekeeper

A Cloudflare OS Gatekeeper is a service-specific intermediary between Cloudflare OS and an external system of record. It understands that service's API, resources, and operations; holds the OAuth credential; grants a constrained typed capability to the agent or app; enforces policy; records resource observation; and mediates externally visible effects. (Source: sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work)

Scope of control

The article's GitHub example illustrates the intended granularity: a Gatekeeper can scope the agent to one repository, allow issue reads but not source-code access, mask selected fields, apply rate limits, and require approval before merging a pull request. It is therefore more specific than a tool-level MCP allowlist and more focused than a generic outbound proxy.

Cloudflare OS agent/app
         │ typed resource capability
         ▼
     Gatekeeper
  • service API semantics
  • OAuth credential custody
  • resource/action policy
  • masking and rate limits
  • observation audit
  • approval for side effects
         │
         ▼
external system of record

Why a Gatekeeper exists

MCP can prevent a caller from invoking an unavailable tool, but tool access alone does not identify the concrete resources returned by a tool or govern dissemination of data derived from them. Gatekeepers supply the service-specific resource semantics required by observation-coupled authorization.

The mechanism composes two previously documented Cloudflare security shapes:

• Credentialed proxy sandbox: credentials stay outside generated code and are injected at a controlled boundary.
• Outbound Worker proxy: outbound traffic can have one policy and audit chokepoint.

Gatekeepers add the source article's distinct property: resource observation influences future sharing and egress authorization.

Limitations

The source does not describe Gatekeeper implementation language, policy schema, audit-log retention, exact typed-binding format, authorization cache behavior, revocation propagation, or how it maps policy into third-party MCP servers. It also does not disclose operational scale or failure semantics when a Gatekeeper is unavailable.

Seen in

• sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work — first public disclosure.

Related

• systems/cloudflare-os — host platform.
• concepts/observed-resource-provenance — policy input captured after an allowed read.
• patterns/observation-coupled-authorization — policy-continuation pattern.
• concepts/information-flow-control — broader runtime-flow-control lineage.
• concepts/least-privileged-access — resource/action-level authorization principle.