When you start building mechanisms for AI to handle internal business data, progress usually halts at the exact same spot: how far should you go in handing keys to the agent? If you want it to query an inventory database, you need DB connection credentials. If you want it to view a customer management system, you need an API key. The moment you decide to "issue a read-only key and place it in environment variables," that key gains the potential to appear within the code generated by the agent.
Generated code might appear in logs. It might get mixed into error messages. When reading external documents, instructions might be injected, causing the keys to be exfiltrated alongside other data. Once you hand over the keys, this anxiety can no longer be eliminated through design.
Cloudflare OS, released by Cloudflare under the Apache 2.0 license on August 5, 2026, aimed to alter this very structure. Despite its name, it is not an operating system like Linux or Windows, but a foundation for running AI agents, applications, and business workflows.
An architecture where credentials never reach the agent
The core premise behind Cloudflare OS is clear. Agents receive neither raw API keys, OAuth tokens, nor database connection details. They receive only scoped "capability references" that can access specific resources under specific policies.
Actual credentials remain inside the layer Cloudflare calls the Gatekeeper Worker, reaching neither the agent itself nor the code it generates. The agent submits a request saying "please perform this action," and Gatekeeper executes it after verifying permissions. The keys never leave.
This design is effective because it alters the nature of potential incidents. In setups that hand over keys, the blast radius instantly spans all permissions granted to that key the moment it leaks. In setups passing only capability references, even in a leak, actions cannot exceed the scope permitted by that reference. When designing around the premise that agents can be compromised, this is where the difference emerges.
What lies behind "building without developers"
Another pillar is the agent workspace accessible from the browser. Employees conduct research, create materials connected to live data, automate business workflows, and assemble and share small internal applications. Each assembled app comes equipped with its own dedicated database, real-time capabilities, and access controls.
What warrants attention here is not the "no developer needed" sales pitch itself, but the fact that independent databases and access controls are included from the start. When small internal business tools proliferate, the problem is rarely functionality; it is losing track down the road of who can view what. Rather than leaving that to bespoke design, the platform handles it.
The environment where agents write and execute code is also partitioned into isolated runtimes. There is a prior constraint to operate strictly within the context and skills provided by the organization, inside of which the agent acts freely. The philosophy that the platform dictates the bounds of freedom aligns consistently with how credentials are handled in the previous section.
Cloudflare stated that it distributed an initial version to all employees in May 2026, and by August, thousands of employees, including non-engineers, were using it daily. Primary use cases are said to include document creation, slide generation, and building minor internal applications.
Building in-house vs. relying on existing SaaS
Just because Cloudflare OS has been open-sourced does not mean deploying it in-house is necessarily the best path. The decision hinges on the data handled and your operational structure.
| Option | Best suited for | Incurred costs |
|---|---|---|
| Using existing SaaS | Data is non-confidential and workflows are standard | Data location and permissions depend on vendor design |
| Deploying a platform like Cloudflare OS in-house | Numerous connections to internal systems and a desire to own permission design | Taking on platform operations, updates, and incident response |
| Building bespoke internal tools individually | Target operations are limited to one or two workflows | Permissions fragment as tools proliferate |
The principle of never handing keys to agents is something you can take away regardless of the option chosen. Even when choosing existing SaaS, how that service connects to internal systems and where connection information is stored are essential items to verify.
If you are at a stage where you cannot track who is using which AI tools within the company, sorting that out must precede discussions about infrastructure. The rollout sequence is addressed in Shadow AI and Cloud AI Governance.
Furthermore, designing permissions for agents requires assuming that human approval during execution cannot be counted on as a safety catch. We summarized the limitations of approval screens in AI Agent Approvals Are Not Safety Catches. Attempting to resolve business processes solely with language models encounters other hurdles, so refer to Enterprise AI Cannot Stand on Language Models Alone for pairing them with deterministic processing.
What to do next
Pick one AI integration currently running or under consideration in your company, and write down where the credentials used there are stored and who is in a position to read them. If the answer is that they sit in plaintext inside environment variables, that is where work must begin before adding new features.
From there, evaluate whether there is a way to avoid handing over the keys. In many cases, inserting a single thin layer in between is enough to alter the architecture.
If you would like to consult on designing internal AI infrastructure or secure connection methods with existing systems, we handle requests through GleamHub's Development, AI, and Automation Consultations. Because optimal configurations depend on the number of connection destinations and data sensitivity, we provide individual quotes. Please reach out via Contact Us.
Sources
- Cloudflare OS Is the First AI Workspace Built Around How Companies Actually Work — Cloudflare
- Cloudflare launches Cloudflare OS: an open-source AI agentic workspace for the enterprise — SiliconANGLE
- Cloudflare OS: Here’s What’s Inside the Open-Source AI Agent Platform — Decrypt
- Cloudflare Releases Open-Source "Cloudflare OS," an AI Workspace Enabling Agents to Leverage Organizational Business Knowledge, Systems, and Apps — gihyo.jp
- Cloudflare Announces Open-Source Cloudflare OS As AI “Operating System” — Phoronix
