Source: Cloudflare — 2026-08-05
Summary
Cloudflare open-sourced "Cloudflare OS" under Apache 2.0 — not an actual operating system, but an isolated-runtime and permissions framework for AI agents, built on Cloudflare Workers. It centers on a "Gatekeepers" governance layer that controls what an agent can access, plus provenance tracking that records every resource an agent reads and follows that lineage into whatever the agent produces.
Key Takeaways
- Despite the "OS" name, this is a sandboxing and governance framework for agents, not a kernel or bootable system — the name is a metaphor for "the layer everything else runs inside of."
- The "Gatekeepers" layer is the access-control piece: it decides what resources, tools, or data a given agent is allowed to touch before the agent's own reasoning gets a say.
- Provenance tracking is the standout feature — every piece of data an agent reads gets recorded, and that record follows through into the agent's output, so you can trace a claim in a final answer back to the specific source it came from.
- Being open-sourced on Workers (Apache 2.0) means teams can inspect and self-host the sandboxing logic rather than trusting a closed platform's agent-safety claims on faith.
Reel Script
Hook (16s)
When an AI agent hands you an answer, can you actually trace which document it pulled that specific claim from? Cloudflare just open-sourced a framework built to make that traceable by default.
Core Concept (95s)
Two separate problems get solved here, and it's worth keeping them apart. The first is access control: an agent running with broad permissions is a liability — if it can read any file or call any tool without restriction, one bad prompt or one compromised input can turn it into a data-exfiltration path. Cloudflare OS's "Gatekeepers" layer sits in front of the agent and decides, resource by resource, what it's actually allowed to touch — think of it as a bouncer checking IDs before the agent even gets to reason about whether it wants something, rather than trusting the agent's own judgment to stay in bounds. The second problem is provenance, and it's the more novel piece: normally when an agent reads ten documents and synthesizes an answer, you have no idea which of those ten documents any specific sentence in the output actually came from. Cloudflare OS tags every resource the agent reads and carries that tag forward, so the lineage of a claim in the final output can be traced back to its source — like a citation system that's enforced by the runtime itself instead of the model politely remembering to cite things.
Hands-On (85s)
The architecture worth sketching is a pipeline: agent requests a resource → Gatekeeper checks whether this agent, in this context, is allowed to read it → if approved, the resource gets tagged with a provenance record → agent processes it → that tag propagates into whatever the agent outputs, whether that's a summary, an action, or a piece of generated code. It's built on Cloudflare Workers, so the sandboxing and permission checks run in the same isolated-runtime infrastructure Cloudflare already uses for edge compute, and it's released under Apache 2.0 — meaning any team can pull the actual enforcement code apart and see exactly how the Gatekeeper and provenance layers work, rather than taking a vendor's "our agents are safe" claim on faith.
Takeaway (24s)
If you're deploying agents against real internal data and can't currently answer "where did that come from" for a given output, this is worth a look — provenance tracking that's baked into the runtime, not bolted on after the fact, is the more defensible way to run agents at scale. Go check whether your current agent stack can actually answer that question today.