<- all tokdocs
2026.08.06@whitewhoadie

Cloudflare Open-Sourced the AI Workspace It Runs Internally, and the Interesting Part Is the Permission Model

AI
Watch on TikTok

View on TikTok ->

Cloudflare released the agent workspace its own employees use every day, and the design choice worth studying is that every agent starts with access to nothing. The video walks through Cloudflare OS, a self-hostable platform where you ask an agent to build small apps and it runs each one in its own sandbox. The presenter frames it correctly: this is not a chatbot wrapper. The system is on GitHub under Apache 2.0, and the README shown on screen describes it as "an AI productivity environment" that a large part of Cloudflare's workforce, from engineering to sales, uses to do their jobs.

What "Operating System" Actually Means Here

The name is a stretch if you read it literally. Cloudflare OS is not a computer operating system. Cloudflare's own README, visible in the video, uses the term in two senses: an operating system for a company to be productive with AI safely, and an operating system for AI workloads in the way a traditional OS manages resources and isolation. In practice it is a browser-based workspace that combines agent sessions, file storage, resource access, and an isolated runtime where agents write and execute code. The closer analogy is a managed environment for running agents against your company's real systems without letting them touch things they should not.

Gadgets and the Sandbox Model

The presenter's clearest point is the "gadgets" concept. You can ask an agent to build an app, and Cloudflare calls these gadgets. Each one runs in its own sandbox rather than shared infrastructure. Under the hood, when an agent builds an app, the server code loads as a Dynamic Worker instantiated as a Durable Object Facet. Each app gets its own SQLite database and its own lightweight V8 isolate. Outbound networking is disabled by default, so a generated app cannot quietly exfiltrate data. This matters because the whole pitch is letting non-technical people build and run tools without a security review for every one.

Gatekeepers: Where the Security Lives

The transcript describes gatekeepers as sitting "in front of everything," like MCP servers. That is close. Gatekeepers are service-specific Workers that mediate access between Cloudflare OS and external services. They handle OAuth credential management, log every resource an agent observes, enforce rate limits, and require approval for any action with external side effects. The presenter notes you can approve actions without freezing the agent mid-task, which maps to Cloudflare's async approval flow. The logging piece is the part enterprises will care about most. Cloudflare says the platform records every resource an agent reads, and those observations stay attached to the agent's work, so when someone else opens a shared output the gatekeepers re-check whether that person is allowed to see the underlying data.

Capability-Based Security by Default

This is the design decision behind the "starts with access to nothing" line. Agents receive no permissions up front. When you grant access to a resource, the agent gets a typed binding, for example env.PROJECT, that represents permission under a specific policy. Credentials stay isolated from the generated code, so the model never handles raw secrets. You hand it one resource at a time. This is the opposite of the common pattern where an agent gets broad API keys and you hope the prompt keeps it in line. It is also why Cloudflare can claim non-technical users can experiment freely without the security team losing sleep.

What It Takes to Run It

The video ends with "one command to run it locally," pointing at github.com/cloudflare/cloudflare-os. That is roughly accurate for a local dev setup. For actual deployment there is a separate cloudflare-os-starter repo with templates, and you deploy into your own Cloudflare account with your own Access policies and AI Gateway configuration. So the honest version is: local trial is quick, but a real rollout means you are standing this up on Cloudflare's platform and wiring in your own auth and integrations. There is no fully managed hosted dashboard yet, though Cloudflare has said one is planned.

Key Takeaways

  • Cloudflare OS is a real open-source release under Apache 2.0, not a demo or a wrapper. The repo is cloudflare/cloudflare-os.
  • The core idea is capability-based security. Agents start with zero access and get typed, policy-scoped bindings one resource at a time.
  • "Gadgets" are agent-built apps, each isolated in its own Dynamic Worker, Durable Object, SQLite database, and V8 isolate, with outbound networking off by default.
  • Gatekeepers handle OAuth, log every resource observed, and gate side-effecting actions behind async approval without stalling the agent.
  • Running it locally is easy. A production deployment requires your own Cloudflare account, Access policies, and AI Gateway setup, so budget for that if you are evaluating it seriously.

Resources

Published August 6, 2026. Writeup generated from a favorited TikTok.