Overview
- Cloudflare published the rebuilt Cloudflare OS code to GitHub on Thursday, giving other organizations access to the agent workspace, governance layer, and a starter deployment.
- The platform uses a zero-access-by-default model where service-specific Gatekeeper Workers hold credentials, perform OAuth, enforce policies, and log every resource an agent reads.
- An observation log ties reads to any agent output so Gatekeepers check a viewer's permissions against the underlying data before showing results.
- Agent-built apps run as real Cloudflare Workers using Dynamic Workers and Durable Object Facets and talk to clients over Cap'n Web, providing isolated per-app runtime and state.
- The release is limited: the runtime and hosted execution remain on Cloudflare's edge, initial deployments require the Workers Paid plan, and Cloudflare plans managed tooling and partner-led rollouts with firms such as Presidio and Happy Cog.