Cloudflare OS Bets on Never Trusting Its AI Agents

Cloudflare OS, built by the team behind the Workers runtime, lets AI agents perform real-world actions — merging PRs, sending emails, editing records — without assuming those agents are reliable. Its core mechanism, a service called the Gatekeeper, mediates every side-effecting action an agent takes and can simulate the outcome of actions that haven't been approved yet, handing the agent a fabricated view of a completed merge so it can keep working while the real effect waits in a queue for a human to commit or discard.

The same distrust shapes the rest of the design. Every app or document runs in its own isolated Dynamic Worker with a private Durable Object and SQLite database, reviving ideas from Sandstorm that are now cheap thanks to V8 isolates. With no shared tenant boundary in code, a bug an agent writes can't leak data across users — isolation is enforced by the platform, not application logic. Agents also never hold raw credentials; they receive narrow, revocable capabilities issued through the Gatekeeper, following an object-capability model.

For engineers building agentic tooling, the takeaway is structural: rather than trying to make agent output trustworthy, Cloudflare OS makes trustworthiness irrelevant to safety, decoupling continuous agent action from discrete human approval so throughput and control stop competing.