Cloudflare Open Sources a Platform That Tracks What Agents Read

An organization is, among other things, a very large body of accumulated instruction. It has a mission, and underneath the mission sits everything required to pursue it: the vocabulary, the procedures, the systems, the standards, the particular ways this company does a thing that a hundred other companies do slightly differently. New people absorb that over months, combine it with whatever they already knew, and start producing work — code, documents, presentations, decisions, relationships.

Code is unusual among those outputs because it comes with a fast and unambiguous verdict. It runs or it doesn't. That tight feedback loop is a large part of why AI agents — software that is given a goal and takes actions on its own to reach it — became useful to software developers before anyone else. There was a cheap way to tell whether the machine had done the job.

Nobody else's work has a compiler. For an agent to be useful to a recruiter, a finance analyst or a customer support lead, it needs two things a coding agent mostly got for free: it has to know how this specific company works, and it has to reach the systems where the work actually lives — the ticket tracker, the data warehouse, the customer database. The first is a matter of writing things down. The second is where the difficulty starts, because reaching into internal systems is exactly the thing a security team spends its career preventing. The open question, then, is whether a company can extend that reach to thousands of people who have never had to think about access control, and not create a disaster.

Cloudflare, the American company that sits in front of a large share of the world's websites, has spent the past year answering that question in-house. Since May, its own staff across every function have been using an internal system that gives each person an agent and a workspace loaded with the company's own context and a shared library of skills — written-down procedures an agent can follow, so that when one person works out a better way of doing a recurring task, everyone inherits it. This week the company released a rebuilt version as open source software, meaning any organization can read the code, run it on its own account and change it.

Why handing over the keys does not scale

The first thing people ask for when they start using AI at work is an API key — a long string of characters that authenticates a program to a service. It is the obvious move and a bad one. Keys tend to grant broad powers for long periods, they are awkward to narrow down, they are dangerous to pass around, and once one is in circulation it is very hard to reconstruct who used it for what.

There is an established improvement on this. The Model Context Protocol, a standard for connecting AI systems to external tools, lets a server hold the credential itself and expose only a defined menu of actions to the agent. The agent never touches the key; it just calls the tools it has been offered.

Cloudflare's argument is that this solves only the front half of the problem. Knowing which tools an agent may call tells you nothing about which underlying records it actually looked at. An agent that reads a sensitive table can carry what it learned into a summary, a chart, a shared document or a piece of software it writes for a colleague. Permission has to follow the data forward, not just guard the door it came through.

A ledger of everything the agent has seen

So the platform keeps one. Every resource an agent observes is recorded, and that record stays attached to the agent and to everything it produces. When a second person opens the workspace, talks to the agent or looks at what it made, the system checks that this person is entitled to see the underlying material. A dashboard built from a restricted table cannot become a way of quietly sharing the table. The same log governs what the agent may do next: having read something sensitive can bar it from writing to certain destinations, pulling in new collaborators or making an outbound request.

The gate itself is a piece of software Cloudflare calls a Gatekeeper — a small service written for one external system, which understands that system's records and the operations available on them. Rather than granting an agent a whole code-hosting account, a Gatekeeper can expose a single repository, permit reading bug reports but not source code, hide particular fields, cap request rates and demand human approval before anything is merged. It holds the credential, applies the policy and logs the reads. The agent sees only a small typed interface. Agents and generated code start with access to nothing at all and receive capabilities one at a time; server code runs with general internet access switched off, and browser code runs inside a sandbox, so neither can reach anything it was not explicitly handed.

Each file is its own program

The other half of the design concerns what people build. Instead of a fixed suite of document, spreadsheet and presentation tools, each artifact here can be a small full-stack application with its own interface, its own logic and its own database, written by the agent on request and private unless shared. You can share the running app, so colleagues collaborate on the same data, or share a blueprint — the code, without the data, credentials or connected systems, so every copy starts clean and independent.

That is the point at which collaborative software usually calcifies, and the design tries to route around it: rather than filing a feature request and waiting for whoever owns the tool, a colleague takes their own copy and changes it with the agent's help. The methods the agent calls are the same ones the person calls, so a tool you build to do a job can be operated by an agent when you are not there.

What the people building this expect to break

One of the engineers behind it describes the platform as a second attempt at a personal-app system he founded a decade ago and could not make work at the time, because too few people had the skill or the patience to modify their own software. His claim is that AI removed that barrier, rather than the original idea having been wrong.

Practitioners who run corporate IT are less sure the second attempt lands. Their objection is not that end users get to add features; it is what happens afterwards, when a dozen people have each customized the same tool, each version saves slightly different output, and nobody can read anyone else's. Others point out that pushing customization to everyone also pushes data-protection duties to everyone — the handful of staff currently trained to think about regulated health or financial records becomes the entire workforce, most of whom have had no such training. And people examining the security model note how much of it rests on the sandbox holding: the guarantee is only as strong as the rule that nothing leaves except through a capability someone deliberately granted.

Which is where the real test lies. Governance built into the platform itself — agents that begin with nothing, mediated access to each system, a record of what was read that follows the work downstream, and apps isolated one from another — is what makes it defensible to let people who are not engineers point agents at company systems at all. Whether that survives contact with an actual organization is a different question, and the unanswered one: when everyone maintains their own version of everything, how does a company stop the versions drifting apart faster than anyone can reconcile them.