Cloudflare ran it internally from May 2026, then open-sourced it in August. It gives every person a browser workspace with an agent grounded in company context, lets anyone build small full-stack apps without a developer, and puts a capability layer between those agents and the systems they act on. The interesting part is not the workspace. It is that an agent here starts with access to nothing and never once holds a credential. This is a full technical read: the architecture, the security model, the stack, what it is good for, and what it costs.
Most coverage stops at 'AI workspace', which undersells it. Cloudflare OS is really three products that only make sense together: a grounded agent, a way for anyone to build software, and a permission system strict enough that the first two are safe to give people.
A browser tab per person, grounded in curated company context and a shared skills library. It researches against internal data, writes documents, slides, and spreadsheets that can stay connected to live sources, and runs workflows on a schedule or an external trigger. The skills library is the part that compounds: a procedure one person gets right becomes something everyone can run.
Full-stack applications written by the agent or the user. Each one gets its own sandbox: a Dynamic Worker for server code, a Durable Object Facet with a private SQLite database for state, a sandboxed browser frame for the UI, and Cap'n Web carrying calls between them. Private by default, shareable two different ways, editable forever. No developer required to make one, and no blast radius when one breaks.
The reason this is interesting rather than another chat wrapper. Agents start with access to nothing. Reaching a company system means asking for one named resource, getting human approval, and receiving a typed function rather than a key. Gatekeepers hold the credentials, scope the access, mask fields, rate limit, and log every resource observed, which is what makes safe sharing possible later.
Four tiers. The thing worth noticing is how little trust each one extends to the next: the workspace cannot reach the network, the sandbox cannot reach the network, and the only path out is a Worker that holds the credential and decides what comes back.
A browser tab. No install, no new infrastructure for the user.
One Durable Object per workspace. This is what makes it multiplayer.
Agent-written code runs here, with outbound networking off by default.
The only way out. No agent ever holds a credential.
Read it top to bottom as one request. The workspace never talks to GitHub. It asks the kernel, which runs code in a sandbox that cannot reach the network, which calls a gatekeeper that holds the credential and decides what comes back.
Cloudflare OS is a showcase for a decade of Workers platform work. Several of these primitives shipped in 2026 specifically because this needed them, which is why the whole thing is hard to reproduce on another cloud.
| Component | Role | What it does here |
|---|---|---|
Cloudflare Workers | Runtime | The runtime everything sits on, including the open-source workerd if you self-host outside Cloudflare. |
Dynamic Workers | Sandbox | Runs agent-generated code in a V8 isolate rather than a container. Cloudflare puts this at roughly 100x faster startup on about a tenth of the memory, which is what makes a per-app sandbox affordable. Outbound networking is off by default. |
Durable Objects | State | One per workspace. This is why a workspace is real-time and multiplayer rather than a single-player chat window. |
Durable Object Facets | Per-app database | Lets dynamically loaded code instantiate its own Durable Object with a private SQLite database. A supervisor object handles logistics and access control; the facet holds the app's data and cannot read the supervisor's. Open beta, Workers Paid plan. |
Cap'n Web | RPC | Cloudflare's open-source object-capability RPC system, JavaScript-native, used between a Gadget's browser client and its server. Capability-based by design, which is the same idea the security model uses one layer up. |
Cloudflare Access | Identity | Identity. Zero trust by default: every user and every request is verified before anything is served. |
Cloudflare AI Gateway | Model routing | Every inference call routes through it. That is where model choice, provider swapping, cost attribution per person or team or workspace, and budget enforcement live. Local models through Ollama are supported, which removes the third-party-provider question entirely. |
MCP Server Portals | Tool integration | Existing Model Context Protocol servers plug in as a source of tools, so an organisation that already invested in MCP does not start over. |
Gatekeepers | Mediated access | Service-specific Workers, one per external system. Cloudflare ships them for GitHub, Google, Cloudflare, Supabase, Notion, Confluence, Slack, Spotify, ZoomInfo, Home Assistant, and Email Workers. Each needs its own OAuth setup. |
Sourced from Cloudflare’s announcement post, the press release, the cloudflare/cloudflare-os README, and the Dynamic Workers and Durable Object Facets docs, all read on 14 August 2026. This is early-access software and the surface is moving, so check the repo before you budget against any specific number here.
This is the part worth copying even if you never deploy Cloudflare OS. The industry default is to hand an agent an API key and hope the prompt holds. Here, approval produces a typed function instead, and the credential stays in a Worker the agent cannot see.
No tokens, no scopes, no ambient network. An agent that has just been created cannot reach a single company system, and neither can the code it writes.
default denyNot "GitHub". One repository, read-only. The request is scoped at the resource level and a human approves it. High-impact writes can require approval every time, not once.
human in the loopApproval produces a function it can call. The OAuth credential stays inside the gatekeeper, invisible to the agent and to any code the agent generates.
capability, not credentialThe gatekeeper logs which resources were touched, masks fields it should not return, and applies rate limits. That log is attached to whatever the agent produced.
observation logWhen the output is shared, gatekeepers re-check the recipient's own access to every source the agent read. You cannot launder data to a colleague through a document.
taint tracking
const issues = await env.PROJECT.listIssues({
teamId: "ENG",
state: "open",
});A typed method on a binding. There is no token in this code, no base URL, and no way to widen the scope from inside the sandbox.
Getting this wrong is how internal tools leak. One mode shares the running thing, data and all. The other shares only the shape of it. Cloudflare separated them deliberately.
Recipient needs their own access to everything the agent read.
No original data, history, or credentials travel with it.
Cloudflare reports thousands of internal users across every function, many of them not engineers. That is the tell: the value shows up in the roles where a general assistant is least useful, because the answer depends on internal policy and internal data.
An agent that reads the ticket system through a scoped gatekeeper, drafts the reply in your voice against your actual policy documents, and escalates on rules a human wrote. The skill is shared, so every rep runs the same procedure.
Spreadsheets that stay connected to the source instead of going stale the moment they are exported. A recurring close checklist that runs on a schedule, pulls the numbers, and flags only the lines that moved.
Account research assembled from internal CRM plus enrichment, with field masking so the agent never sees the columns it has no business seeing. A Gadget that tracks a pipeline the way one team actually runs it, not the way the CRM insists.
Read-only access to one repository, issue triage that respects your labels, and internal dashboards built in an afternoon by whoever needed them. Container support for development workflows is on the roadmap, not shipped.
The functions where a general assistant is least usable, because the answer depends on internal policy. Grounding plus per-resource access is precisely the combination those teams have been missing.
The strongest argument in Cloudflare's post: if you can build a tool to do a job yourself, an agent can use that tool to do the job when you are not there. Gadget plus schedule plus gatekeeper is that sentence made concrete.
Three paths, in ascending order of how much you own. The demo takes minutes. A deployment your company actually uses takes gatekeepers, and gatekeepers take OAuth setup and access policy, which is the real work.
git clone cloudflare/cloudflare-os
pnpm install
pnpm run-localServes on localhost:8787. Enough to judge whether the workspace model fits how your teams work. No Cloudflare account touched.
os.cloudflare.app/deploy
or cloudflare-os-starterInto your own Cloudflare account, in minutes. This is where the Workers Paid plan requirement bites, because Dynamic Workers will not run on the free tier.
Gatekeepers per system
Skills library
Access + AI Gateway policyThe part that is a project rather than a command. One gatekeeper per external service, each with its own OAuth setup, scoping, masking, and approval rules.
A managed offering through the Cloudflare dashboard is announced but not shipped, and Cloudflare names Presidio and Happy Cog as launch partners for enterprise rollout. Container support for development workflows and a Slack integration are on the roadmap.
We build on Cloudflare daily, so read this as enthusiasm with the caveats attached rather than a launch summary. The architecture is the most serious answer we have seen to the agent-access problem. The product around it is young.
That is a direct quote from the README, not our editorialising. External pull requests are discouraged beyond trivial fixes under twelve lines, which tells you the project is moving fast internally and is not yet shaped for outside contribution. Plan a pilot, not a rollout.
Gadgets need Dynamic Workers, which need a Workers Paid plan, and Durable Object Facets are in open beta on the same plan. It is easy to read an Apache-2.0 announcement as free and discover the infrastructure line afterwards. Size Workers Paid plus Durable Objects storage plus inference before you commit.
The sandbox is a V8 isolate, which buys speed and density and carries a different escape threat model than a container or a virtual machine. Cloudflare also describes the observation and approval machinery as still evolving. Both are reasonable for internal tooling. Neither is a finished answer for regulated data, and we would not pretend otherwise to a client.
The thing that makes this good, anyone can build and fork an app, is the thing that produces two hundred half-maintained internal tools in eighteen months. Nobody has solved this. Decide early who owns retirement, and treat the skills library as the curated layer rather than letting every Gadget be a fork.
The gatekeeper model contains what an agent can reach. It does not by itself stop a provider seeing what the agent read. Routing local models through Ollama removes that concern and costs you capability. That trade should be a deliberate decision, made per workload, not a default someone inherited.
Every model we integrate runs through the same operating system. Three pillars, sixteen layers, one Compound Growth Loop. The methodology that keeps AI work from rotting after the first ship.
Read the K-FrameworkDirect API integration with the model. No LangChain, no orchestration vendor, no agent framework built on quicksand. Typed contracts, the same way we wire up Postgres.
An eval suite built from your real tasks gates every prompt and model change. Quality is measured before it ships, not vibed in a demo.
Governance, audit, and oversight wired in from day one. Who called what, with which prompt version, at what cost. Your auditors get answers, not screenshots.
A model in production without observability is roulette. We instrument every integration so engineering and finance can see the same numbers, and so a regression at 3am surfaces before a customer opens a ticket.
Tokens in, tokens out, dollars spent. Sliced by feature, tenant, and route. Budgets enforced where it matters.
Real distributions, not averages. We know which routes are slow, and why.
The same eval suite that gates a release runs continuously in production. A regression on real traffic surfaces fast.
PII scrubbed at the proxy, shipped to your SIEM. Retention controls match your compliance window.
Dashboards your team owns, not ours. At handoff you get the queries, the alerts, and the runbook. We are not in the path to read your metrics.