Introduction
In May 2026, Cloudflare rolled out an internal platform giving every employee the ability to build internal applications, automate workflows, and interact with company systems through AI agents. Three months later, that same platform was released as open source under the name Cloudflare OS. What might look like a standard product announcement is actually an architectural response to a problem that platform engineering teams know all too well: how do you provide a secure, multi-tenant execution environment for applications built dynamically by non-developers?
Two New Primitives for Isolation
The core constraint was easy to state, hard to solve: if any employee can spin up an application, each application must run in strict isolation — no shared state, no shared databases with neighboring workloads.
To solve this, Cloudflare developed two building blocks that didn't exist in its existing catalog: Dynamic Workers and Durable Object Facets. Dynamic Workers allow code to be loaded on the fly without manual deployment — every application generated by an agent becomes a self-contained Worker, instantiated on demand. Durable Object Facets solve the storage problem: each Dynamic Worker gets its own SQLite database instance, fully isolated, with no additional configuration required.
The result: an agent-built application has no structural way to access another application's data. Isolation is enforced at the runtime level — not by convention or developer discipline.
Security Encoded in Workers
The second challenge was access control. An agent acting on behalf of an employee shouldn't be able to read an entire repository when it's only asked to check a single issue. Cloudflare OS addresses this with Gatekeepers: specialized Workers that sit between an agent and every external system it interacts with.
Each Gatekeeper defines precise rules — read-only access to a specific path, field masking, rate limits, required approvals for sensitive operations. By default, agents start with zero access. The platform also logs every resource an agent has observed, and that audit trail becomes active security data: Gatekeepers query it when a third party attempts to access a workspace.
This is security-as-code in practice: access policies are versioned, testable, and deployable Workers — treated like any other infrastructure component.
Open Sourced After Production Validation
Cloudflare OS is not a turnkey solution. Two repositories are available as open source: the core platform and a reference deployment based on Cloudflare's own internal usage. Integration partners support customization of Gatekeepers and security control configuration to fit each organization's systems.
What deserves particular attention is the release sequencing. Cloudflare deployed Cloudflare OS to thousands of its own employees — across every business function, not just engineering — before opening the code. That order of operations is rare. Most platforms are released before they've been genuinely stress-tested at scale. Here, Dynamic Workers and Durable Object Facets were built to meet a concrete internal need, then refined over several months before any public announcement.
What DevOps and Platform Teams Should Take Away
For platform engineering teams, the value of Cloudflare OS lies not in its end-user features but in the underlying architecture. The combination of an isolated Worker plus a per-instance SQLite database solves a multi-tenancy problem that many Internal Developer Platforms work around rather than truly address. The Gatekeeper model offers a reference pattern for controlling agent access to internal systems without creating additional attack surface.
The open-sourced codebase documents technical decisions that have been validated at the scale of a major cloud vendor. For anyone building or evolving an internal platform, it's a concrete case study that goes well beyond API documentation.