Cloudflare has introduced Cloudflare OS, an open platform designed to give employees, teams, and agents a shared workspace grounded in company context, access controls, and internal systems. The company says the new release is meant to move AI beyond code generation and into everyday business work such as documents, slides, workflows, and internal apps.
Cloudflare OS moves beyond coding assistants
Over the past couple of years, AI agents have become useful for one narrow kind of work: generating code that can be tested and verified. Cloudflare says the harder challenge is bringing similar leverage to the rest of an organization, where tasks depend on company terminology, procedures, systems, and standards.
That is the problem Cloudflare OS is meant to address. The platform gives each person an agent and workspace tailored to how their company works, what it knows, and the systems it relies on. According to Cloudflare, the internal version has already been used by thousands of employees across the company, including many outside engineering.
What the first version taught Cloudflare
Cloudflare says it first rolled out an early version of Cloudflare OS internally in May. That version focused on individual workspaces, static apps, and agent sessions, but collaboration exposed a major issue: access control had to extend beyond which tools an agent could call and into which underlying data it had actually seen.
The company also found that simply connecting an agent to an MCP server was not enough. Once outputs, apps, and workspaces were shared, Cloudflare needed a way to prevent people from seeing information they were not allowed to access, even indirectly through generated work.
Cloudflare says the new architecture was rebuilt with security and governance at the platform level so that every app or agent does not have to solve those problems independently.
How Cloudflare OS is structured
Cloudflare describes Cloudflare OS as combining three major pieces:
- An agent workspace with curated company context and skills, plus an isolated runtime where agents can write and run code.
- A security and governance framework for safe access to internal data and services.
- A platform for personal, modifiable apps that people can build, share, and continue to change.
The basic interaction starts in a browser, like other AI tools. But Cloudflare says the difference is that the conversation is grounded in context curated by the organization, so the workspace can work toward a specific goal using the tools and data the company already has.
What people can do in a workspace
Cloudflare says the workspaces are intended for anyone in an organization, not just developers. Use cases include research and question answering, with agents able to search, filter, join, and analyze information without loading everything into a model context window.
The workspace can also produce documents, presentations, and spreadsheets that remain connected to live data and can be exported to familiar tools such as Google Drive. When a document or spreadsheet is not enough, the agent can build a connected app with its own interface, logic, and state. Cloudflare also says the platform can automate deterministic workflows that combine code for predictable steps with AI only where judgment is needed.
Security starts with zero access
Cloudflare’s security model is one of the most important parts of the release. The company says agents start with no access at all. Access to company resources must be granted explicitly, and generated code receives that access as a typed binding rather than as a raw credential.
Cloudflare uses the example of a project resource that can be listed only through a capability such as env.PROJECT.listIssues(). In that design, the credential remains isolated from the agent and any generated code. Server code runs in a Dynamic Worker with outbound networking disabled, while client code runs in a sandboxed browser frame.
The platform also uses Gatekeepers, which Cloudflare describes as service-specific Workers that sit between Cloudflare OS and an external system. A Gatekeeper can enforce fine-grained rules, such as limiting access to one repository, allowing issue reads but not source code, masking fields, rate-limiting requests, or requiring approval before a pull request is merged.
Policies follow the data
Cloudflare says its model goes beyond controlling the initial read. The platform records every resource an agent observes, and those observations stay attached to the work. If someone later opens a workspace or views the output, Gatekeepers check whether that person is allowed to see the original resources.
That same observation log can also affect what the agent is allowed to do next. A read of sensitive data may block further actions such as writing to other systems, inviting collaborators, handing work to another agent, or making outbound requests.
Apps become shareable, living workspaces
Another major piece of Cloudflare OS is its app model. Instead of treating productivity tools as fixed documents, spreadsheets, and presentations, Cloudflare says each “file” can be its own application. These apps are not meant to be exported elsewhere first; they are full-stack apps with client code, server code, an API, and durable state.
When an agent builds an app, it creates both the browser interface and the server-side behavior. Cloudflare says the server is loaded on demand as a Dynamic Worker and instantiated as a Durable Object Facet, giving the app its own SQLite database and isolated runtime without a dedicated container or server.
The browser client communicates with the server through Cap’n Web, Cloudflare’s open source object-capability RPC system. Cloudflare says the same methods available to the user can also be called by the agent, which means people can build tools that continue working when they are not present.
Two ways to share
Cloudflare says apps can be shared in two ways. People can share the app itself so others work in the same state in real time, or they can share a blueprint so others can create their own copy.
A blueprint includes the code but excludes the original app’s SQLite data, conversation history, credentials, and connected resources. That lets teams reuse an app’s logic while starting with independent state and access.
Model choice and cost control
Cloudflare OS can work with any model, and every inference call runs through Cloudflare AI Gateway. The company says that gives organizations a single place to decide which models are available and which one should handle each task.
Cloudflare also says all requests are attributed to the person, team, or workspace that made them. Administrators can track spend, set budgets and rate limits, and define what happens when limits are reached. That is intended to keep expensive frontier models focused on harder work instead of routine jobs.
Open source, with partners and a broader roadmap
Cloudflare OS is available now on GitHub, and Cloudflare says organizations can deploy it in their own Cloudflare account using their own Access policies, AI Gateway settings, data, and integrations. The company is releasing two repositories: the Cloudflare OS core and an example deployment based on its internal setup.
Cloudflare also says strategic partners Presidio and Happy Cog will help customers customize and roll out the platform. The company says that includes curating skills and institutional context, building custom interfaces, connecting internal systems through Gatekeepers and MCP Server Portals, and configuring security, model, and cost controls.
Cloudflare says it is also working on a fully managed version in the Cloudflare dashboard, container support for development workflows, and integrations that bring workspaces into Slack and other chat tools.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 10, 2026 at 4:49 pm
1 views
