What Is Cloudflare OS? Architecture and Components Explained

Cloudflare OS at a glance

The name includes “OS”, but this is not an operating system like Windows or Linux. It means a workplace platform for running AI agents inside an organisation.

Cloudflare says several thousand of its own employees already use the platform; that figure is Cloudflare’s own report. It is also a newly released Early Access product. We return to this under adoption considerations.

Why it exists: three limits of general-purpose AI

Giving a company a general-purpose AI tool such as ChatGPT does not automatically make day-to-day work faster. Organisations commonly encounter three barriers.

1. AI does not know how your company works

A general-purpose model does not know internal terminology, procedures or system conventions. If employees must explain these from scratch every time, the time saved in real work remains limited.

2. It cannot reach internal systems

AI needs access to systems such as a CRM or database to create meaningful operational value. Giving API keys directly to employees or agents is risky, however, and makes it difficult to audit who did what.

3. Permission boundaries become unclear

Managing which tools an AI may use is not enough. Unless the organisation can trace which data it read, sharing an AI-produced artefact internally can itself become a route for unintended disclosure.

Cloudflare OS is designed to embed controls in the platform instead of relying on each user’s security awareness to resolve these problems.

How it works: five core components

Cloudflare OS is both an internal AI workspace and a platform for creating AI applications, deployed within the organisation’s own Cloudflare account. It has five principal components. A flat list hides how they connect, so the flow is shown first as three layers.

Typical request flow

An employee first authenticates through Cloudflare Access and opens the workspace. When an AI agent needs to act on an internal system, it must go through Gatekeeper. Every model request also passes through AI Gateway, so the organisation can see and control which models are used and in what volume.

The platform is not guaranteed to be no-code; custom integrations require development. See the official repository for details.

Security model: begin with zero permissions

Cloudflare OS starts from a deny-by-default position and opens only the access a task needs, rather than allowing everything first and attempting to narrow it later.

• Nothing is visible at first — Every agent and application starts with zero access. Resources are requested, and an administrator decides whether to allow or deny them.
• Gatekeeper brokers operations — Controls such as read-only access, masking particular fields and requiring human approval before execution can be applied to individual operations.
• Policy follows the information read — Referenced resources are recorded and linked to outputs. The platform can verify whether a viewer may access the source data and restrict actions such as external transmission after confidential data has been read.

These controls do not eliminate risk. Prompt injection and permission-design errors remain possible, so a limited, read-oriented rollout is the prudent starting point.

What teams can do with it

Conversations in the workspace can produce documents, applications and workflows. Representative uses include the following; these are illustrations, not guaranteed outcomes.

• Sales — Research before meetings, draft proposals and create CRM summary reports
• Customer support — Search enquiries and knowledge bases together, draft responses and FAQs, and analyse trends
• Leadership and planning — Generate cross-functional dashboards and management-meeting summaries
• Human resources — Answer questions about internal policies, coordinate recruitment schedules and produce onboarding materials
• IT — Design Gatekeeper and MCP integrations, operate access policies and monitor logs
• Corporate operations — Check expense summaries, extract contract highlights and turn internal requests into workflows

Adoption considerations

• It is an Early Access product — Cloudflare OS was released only in August 2026, and the official starter asks adopters to pin releases and review changes. A staged rollout beginning with a limited pilot is more realistic than an organisation-wide launch.
• Deployment alone does not create value — Installing the open-source software will not change work by itself. Teams must select suitable workflows, implement Gatekeeper and MCP connections, and train employees so the new approach takes hold.
• A $0 licence does not mean $0 to operate — Workers, Access, AI inference and related services carry separate charges. See the pricing and costs guide.