On 5 August 2026, Cloudflare open-sourced the AI workspace it had been running internally for its own staff. It is called Cloudflare OS, it is Apache 2.0 licensed, and the naming is doing a lot of heavy lifting: this is not an operating system in any conventional sense. It is a browser-based agent workspace with a governance layer bolted to the front of it.
The chat interface is the least interesting part. Every vendor has one. What makes this release worth an hour of your architecture team’s attention is the permission model underneath, because it is the first mainstream attempt to answer a question we have been circling for eighteen months: how do you let non-developers point AI agents at real company data without handing over the keys to everything?
TL;DR
- Cloudflare open-sourced Cloudflare OS on 5 August 2026 under Apache 2.0, an agent workspace it has been running internally across thousands of employees.
- The genuine innovation is the governance model: agents start with access to nothing and receive resources as typed bindings, with credentials never exposed to the agent or its generated code.
- “Gatekeepers” are service-specific Workers that broker every external call, supporting scoped access, field masking, rate limiting and approval workflows for high-impact actions.
- Every document can become a full-stack application, each running as a Durable Object facet with its own SQLite database and isolated runtime.
- The catch is portability: Apache 2.0 code that only runs on Dynamic Workers, Durable Objects, Access and AI Gateway is open source in licence but not in practice.
- The architectural patterns are worth stealing whether or not you deploy the product.
What Cloudflare actually shipped
Cloudflare OS has three parts. There is an agent workspace, grounded in context and skills that your organisation curates rather than generic model knowledge. There is a security and governance framework controlling how agents reach internal data and services. And there is a platform for personal, modifiable applications that staff build, share, and keep changing.
It runs on your own Cloudflare account. Server-side code executes in Dynamic Workers with global outbound networking disabled by default. Client code runs in a sandboxed browser frame. Each application is instantiated as a Durable Object facet with its own SQLite database, which means isolation per app without provisioning a container or a server for each one. Model calls route through AI Gateway, so the organisation decides centrally which models are available and which job goes to which tier, with token attribution by person, team and workspace.
Two repositories are public: the core platform and a starter that mirrors Cloudflare’s own internal configuration. Presidio and Happy Cog are named as implementation partners. The roadmap points at a fully managed dashboard product, containers for development workflows, and Slack integration.
The governance model is the actual news
We have written before about agent sprawl, shadow AI infrastructure, and the identity crisis facing autonomous systems. The recurring failure is always the same: agents get broad credentials because scoping them properly is tedious, and then a prompt injection turns that convenience into an incident.
Cloudflare OS starts from the opposite default. Every agent and every generated app begins with access to nothing. Resources arrive as typed bindings, so an agent references env.PROJECT without ever seeing the token behind it. Credentials stay completely outside the reach of the agent and any code it writes. This is the object-capability model applied to AI, and it is the correct shape.
Gatekeepers do the brokering. A Gatekeeper is a service-specific Worker sitting between the workspace and an external system. It holds the OAuth credentials, narrows access to a single repository or a read-only scope, masks sensitive fields, applies rate limits, and can require human approval before high-impact actions execute. If you have ever tried to give an agent GitHub access without giving it your entire organisation, you will recognise the problem this solves.
The subtler piece is observation tracking. Cloudflare OS logs every resource an agent observes, then uses that log to police sharing. When a colleague opens a workspace you produced, the Gatekeepers verify that person’s access to everything the agent looked at along the way. That closes a leak most teams have not even identified yet: AI output as an unaudited exfiltration path, where the summary escapes the access controls that protected the source.
Every file is an application
The second idea worth taking seriously is that documents and applications stop being different categories. In Cloudflare OS, each “file” can be its own full-stack app with client code, server code, an API and persistent state, written by an agent on request. Sharing works in two modes: direct sharing gives real-time collaboration over shared state, while blueprint sharing hands over an independent copy with its own state, credentials and resources.
The RPC layer is Cap’n Web, Cloudflare’s open-source object-capability RPC system, which lets agent-written client code call server methods as though they were local. It is a clean abstraction, and it is the reason the sandboxing works without the developer experience collapsing.
For a mid-sized business, this is the interesting commercial proposition. The long tail of internal tooling, the reconciliation script, the bespoke report, the small workflow that never justified a sprint, becomes something an operations manager can produce in an afternoon inside a governed boundary.
The honest objections
The developer response has not been uncritical, and the criticisms are fair.
Portability is theoretical. Apache 2.0 is a genuinely permissive licence, but the code targets Dynamic Workers, Durable Objects, Access and AI Gateway. You can read it, fork it and modify it. You cannot meaningfully run it anywhere else. That is open source as distribution strategy rather than as exit route, and you should price the dependency accordingly.
The SharePoint problem is real. Give a hundred non-technical staff the ability to generate bespoke applications and you will get a hundred bespoke applications, most undocumented, several load-bearing, and none owned by anyone after the author leaves. The isolation model prevents security disasters. It does nothing about maintenance sprawl. Someone needs to own lifecycle policy from day one.
Data classification does not solve itself. Typed bindings protect credentials. They do not stop an employee pasting regulated data into an app they built themselves. If you operate under GDPR, and particularly if you are handling special category data, the governance framework is a foundation, not a compliance answer.
Costs are opaque. Dynamic Workers are a paid product and inference runs through AI Gateway. Per-person attribution is a genuine advantage over most enterprise AI tooling, where spend is a single unattributable line item. But you should model it before you roll it out broadly.
What we would advise
If you are already on Cloudflare, this is worth a scoped pilot with one team and a fixed budget cap. The internal tooling backlog is usually where the value shows up first.
If you are not on Cloudflare, do not migrate your platform for a workspace product. Read the architecture instead. The patterns transfer to whatever stack you are running: default-deny access for agents, credentials brokered behind a service boundary rather than injected into agent context, scoped and revocable capabilities per task, approval gates on high-impact actions, and observation logging so shared AI output inherits the access controls of its sources. Those five principles are the durable part of this release, and they hold whether your agents run on Workers, Kubernetes or a box under a desk.
The broader signal is that agent platforms are consolidating around governance rather than capability. The model is no longer the differentiator. The permission boundary is.
Building this properly
Most teams we speak to are somewhere between an unstructured AI pilot and an ungoverned rollout, with agents holding credentials nobody has audited. Getting from there to a default-deny architecture is an engineering project, not a procurement decision.
REPTILEHAUS builds and secures AI agent infrastructure, from Cloudflare Workers deployments and MCP integrations to the access control and observability layers that make agent adoption survivable. If you are weighing up an agent platform, or you have one running and no idea what it can reach, get in touch.
📷 Photo by Taylor Vick on Unsplash
