Skip to content

SYSTEM Cited by 1 source

Cloudflare OS

Cloudflare OS is an open-source, organization-owned agent-workspace platform that combines company-curated context and skills, isolated agent code execution, policy-governed access to systems of record, and full-stack apps that agents can build and use. Its architectural focus is not simply granting an agent tools, but preserving the resources an agent observed so derived outputs, sharing, and later external actions remain subject to authorization. (Source: sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work)

Architecture

A workspace contains agent sessions, persistent state, outputs/files, resource access, curated organizational context and skills, and an isolated runtime. It can turn a conversation into a document, live connected app, or scheduled/event-triggered workflow. The article distinguishes this from the original internal version, where apps were static and repeated agent sessions covered jobs that could instead run deterministically.

Concern Published mechanism
Entry identity Cloudflare Access
Agent/app execution Dynamic Workers with no ambient access
External-service boundary Gatekeeper
App state Durable Object Facet with app-specific SQLite
Browser-to-app RPC Cap'n Web
Existing agent-tool servers MCP via MCP Server Portals
Inference choice, attribution, limits AI Gateway

Security model

Agents and generated apps start with no access. A user can grant a specific resource; generated code receives a typed binding for that resource while its underlying credential remains isolated from agent and app code. Server code runs in a Dynamic Worker with outbound networking disabled, and browser client code runs in a sandboxed frame. This is a concrete deployment of capability-based sandboxing and least privilege.

The system records resources that the agent has observed. It re-checks a prospective collaborator's permissions before they can open a workspace, interact with its agent, or view derived output. The same observation record can constrain outgoing writes, collaboration invitations, hand-offs to other agents, and outbound requests. This is the canonical Cloudflare instance of observation-coupled authorization: authorization follows both the initial capability grant and the data actually read. (Source: sources/2026-08-05-cloudflare-os-an-open-platform-for-agents-apps-and-work)

Generated apps

An app contains browser client code, server behavior, API, and durable state. The server is loaded on demand as a Dynamic Worker and instantiated as a Durable Object Facet, which gives it an isolated SQLite database. The browser calls server methods with Cap'n Web; agents can invoke the same method interface. Apps are private by default. Sharing an app shares the stateful application; sharing a blueprint instead copies code while excluding the original SQLite data, conversation history, credentials, and resource grants.

Operations and limits

Cloudflare says it gave the original internal deployment to every employee in May 2026 and that thousands of people use it daily across functions. It does not publish request rate, workload count, p99 latency, availability, per-workspace cost, Gatekeeper policy-evaluation latency, or isolation-boundary test results.

Seen in

Last updated · 622 distilled / 1,953 read