Agent
Does the work
A general-purpose Code Mode agent writes and runs small programs, uses company context, and can build applications.
08 / REFERENCE ARCHITECTURE
Cloudflare OS explained
A secure runtime for agentic work.
Cloudflare OS makes AI-created apps and agent work private, isolated, and capability-scoped. Pair it with a continuous-learning architecture and those safe actions can also become shared decisions, reusable knowledge, and better future work.
EARLY ACCESS
Cloudflare describes the August 2026 v2 release as capable, but still under heavy development.
Isolated by default→Introduce a capability→Mediate the action→Approve the effect
The core idea
Not a desktop OS.
An OS for AI work.
Cloudflare uses “operating system” in two ways: a company-wide environment for productive, safe AI use—and a runtime that manages agent workloads much as a conventional OS manages processes and devices.
Gadget
Becomes the software
A private, modifiable app instance runs in its own sandbox. Reusable application code can be shared as a Blueprint.
Gatekeeper
Controls the boundary
A service-specific capability layer holds credentials, narrows resource access, logs activity, and mediates side effects.
System map
Security lives at
the boundaries.
Generated code is treated as untrusted. The platform—not the prompt—enforces identity, isolation, egress limits, narrow resource introductions, and approval.
IDENTITY EDGE
PeopleSSO · Access · MFA · device policy
CLOUDFLARE OSDurable workspaceAgent Dynamic Worker FacetGadget Shared codeBlueprint
CONTROL PLANESMODEL CONTROLAI Gateway TOOL CONTROLGatekeepers
Approved models · spend · rate limits · logging
OAuth · resource scope · simulation · approval · audit
SYSTEMS OF RECORD
ModelsGitHubJiraDatabasesDocsInternal APIs
OBSERVABILITY + SIEMmodel useresources observedactions proposedconsent decisionssharing events
Why the “OS” analogy works
Familiar primitives,
new agent semantics.
The analogy is useful because it makes the trust model concrete: applications become processes, connections become device drivers, and agents need permissions that are restricted yet accountable to a person.
Traditional OSCloudflare OS
KernelWorkshop backend
Device driversGatekeepers
ShellWorkshop frontend
ProcessesGadgets
ExecutablesBlueprints
Access controlShared permissions + capabilities
New primitiveAgents accountable to users
Architecture comparison
Execution substrate
meets learning system.
Cloudflare OS and the continuous-learning organization solve adjacent problems. One secures a unit of agentic work. The other decides how work becomes shared meaning and compounds across time.
Cloudflare OS
Safe local agency
Optimize each workspace, agent, and Gadget for productive action without ambient access.
- Sandboxed execution
- Capability introductions
- Gatekeeper approvals
- Private, modifiable apps
Continuous-learning organization
Shared organizational intelligence
Route meaningful outputs into collaboration, decisions, memory, reuse, and governed reflection.
- Private and visible layers
- Communication router
- Memory and cache
- Learning across cycles
| Dimension | Cloudflare OS | Continuous-learning organization | Combined architecture |
|---|---|---|---|
| Primary question | How can people and agents safely build and use software? | How does relevant work become shared understanding and better future action? | How can safe action become governed learning? |
| Core unit | User · workspace · agent · Gadget | Individual · team · organization | Bounded workspaces connected by policy |
| Trust boundary | Sandbox · binding · Gatekeeper · approval | Router · audience · authority · knowledge scope | Capabilities govern access; routers govern meaning |
| Human role | Grant resources and approve side effects | Interpret, decide, correct, and teach | Authorize action and shape what is learned |
| Knowledge over time | Workspace state, company context, observed-resource lineage | Memory, cache, and governed “dreaming” | Operational state feeds reusable organizational knowledge |
| Best at | Secure agent execution | Organizational cognition | Progressive, auditable autonomy |
The bridge
Secure work becomes organizational learning.
Cloudflare OS protects the act. The learning architecture determines what should travel beyond the workspace, who should see it, what authority is required, and what should be remembered.
The combined loop
Six moves from
prompt to progress.
The missing link is a policy bridge between a protected workspace and organizational memory. This is where the two architectures become one operating model.
Execute
An agent works privately inside an isolated Cloudflare OS workspace.
Mediate
A Gatekeeper scopes resources and simulates side effects that need approval.
Promote
The communication router surfaces decisions, risk, evidence, and exceptions.
Decide
People approve the action, correct assumptions, and add judgment.
Learn
Memory preserves, cache reuses, and governed reflection reconciles knowledge.
Improve
Better context and policy return to the next bounded workspace.
Enterprise deployment
Pilot the platform.
Earn the autonomy.
The conceptual security model is strong; the software is still early access. A sensible enterprise adoption path keeps access narrow, environments isolated, and autonomy proportional to evidence.
Zero access first
No data, internet, systems, or write actions until an explicit capability is introduced.
No direct credentials
Agents call Gatekeepers. Gatekeepers retain OAuth tokens and service credentials.
Separate read from act
Allow observation, support preparation, and require approval for consequential execution.
Govern models centrally
Route model traffic through AI Gateway for approved providers, cost, rate, and audit controls.
Pin and promote
Own a company deployment repo; move tested releases through dev, pilot, and production.
Audit the lifecycle
Record what agents observed, proposed, shared, executed, and learned—not only tool calls.
SECURITY VALIDATION→READ-ONLY PILOT→APPROVED ACTIONS→CONTROLLED AUTONOMY→BROAD PLATFORM
Go to the source
Read, inspect,
then experiment.
Start with Cloudflare’s explanation and the open-source implementation. For enterprise use, study the starter and reference architecture before connecting real systems.
01 / BLOG
Cloudflare OS: an open platform for agents, apps, and work
The product idea, security model, Gadgets, Gatekeepers, and Workers foundation.
Read the post ↗ 02 / GITHUBcloudflare/cloudflare-os
The open-source code, architecture mapping, local quick start, and early-access warning.
Inspect the repository ↗ 03 / DEPLOYMENTCloudflare OS starter
A deployment pattern for pinning upstream versions and owning enterprise configuration.
Open the starter ↗ 04 / REFERENCEEnterprise AI agent workspace
Cloudflare’s reference controls for identity, orchestration, models, tools, and audit.
View the architecture ↗Independent architecture analysis based on Cloudflare’s public materials and the local Cloudflare OS architecture document. Product status noted as of August 10, 2026.