Cloudflare OS goes open source with observation log that tracks every agent read

Cloudflare open sourced its agent platform, Cloudflare OS, on August 6, 2026, with a record of every resource its agents read and authorization checks that follow the data. The platform has been used internally since May.

Employees at Cloudflare hit a problem when sharing workspaces: an agent could join data from two systems and hand the result to someone with fewer permissions, leaving no trace. Cloudflare OS solves this by logging every read and enforcing that a second person sees nothing unless they could have read the underlying data themselves.

Observation log ties permissions to data lineage

Every resource an agent reads is recorded in an observation log. That record stays attached to the agent and its output. When a second person opens the workspace, Gatekeeper Workers check that person against the observed resources before showing anything. The same log drives outbound rules, preventing an agent with sensitive data from writing to certain destinations, inviting new collaborators, or making external requests.

• Credentials never reach the agent; Gatekeeper Workers hold OAuth tokens, enforce policy, and log what was read.
• Agents start with access to nothing; each resource is granted via a typed binding under one policy.
• Server code runs in a Dynamic Worker with outbound networking off; client code runs in a sandboxed browser frame.
• Apps built in a workspace get their own SQLite database using Durable Object Facets, with isolated runtimes.
• Apps are private by default; sharing can be collaborative (same state) or a blueprint (code only, no data or credentials).

Open source and future plans

The code is available on GitHub in two repositories: a core and a starter deployment modeled on Cloudflare's internal setup. Model selection runs through Cloudflare AI Gateway, which attributes every inference call to a person or team and sets budgets and rate limits. The stated reason is cost control: summarizing unread mail does not need a frontier model.

Cloudflare OS is not yet a managed product on the Cloudflare dashboard. Containers for development workflows and workspaces inside Slack are still ahead. Strategic partners Presidio and Happy Cog will handle rollouts for organizations that need custom integrations and internal skills. The platform represents a shift in how enterprises can build and share AI-powered micro-apps while keeping data access tightly controlled.