Cloudflare OS Architecture Comparison

Component Comparison of Cloudflare OS Architecture: From Isolated Runtimes to Cost Control

When Cloudflare CTO John Graham-Cumming announced the open-sourcing of Cloudflare OS on August 5, 2026, he revealed a platform that’s been under internal development since May. Thousands of employees have been using it daily to research, create documents, and build small apps. Yet, what really captures attention isn’t just its existence but its innovative architecture, assembled from components that address enterprise challenges like isolation and cost management.

What Cloudflare OS Actually Is

Cloudflare OS isn’t an operating system like Linux or Windows. It lacks a kernel, bootloader, or ISO image. Instead, Cloudflare describes it as a platform composed of three parts: an agent workspace built around curated context and skills, a security and governance framework for safe access, and a platform for customizable apps that users can build, share, and modify.¹

Component Comparison: Dynamic Workers, Durable Object Facets, and AI Gateway

The Security Model: Gatekeepers, Capabilities, and the Observation Log

The security architecture is a core innovation. It addresses the fundamental problem: how to enable an agent to access sensitive resources without risking data leaks or privilege escalation.

Cloudflare Access manages who can enter the platform. Inside, each agent and app begins with zero privileges. Resources are requested via capability objects, typed bindings that grant specific permissions. For example, an environment object capability might look like:

const issues = await env.PROJECT.listIssues({
 teamId: "ENG",
 state: "open",
});

Here, env.PROJECT is a capability representing permission to a resource, with access governed by policies. Credentials stay isolated from the code and runtime. Server code runs in a Dynamic Worker with outbound networking disabled; client code executes in sandboxed browser frames. Neither can reach the Internet unless explicitly permitted.

The Gatekeeper acts as the enforcement point. It’s a Cloudflare Worker that mediates between the platform and external services. It understands each service’s API, enforces policies, manages OAuth credentials, and records resource access. For instance, instead of granting broad GitHub access, a Gatekeeper might allow reading issues in a specific repo but not source code, with rate limits and approval requirements. This fine-grained control prevents privilege escalation and data exfiltration. Cloudflare’s CIO notes that most teams implement custom MCP servers per system of record, adding controls like role-based rate limits.

The observation log extends governance further. While MCP protocols specify which tools an agent can call, they don’t track what resources the agent observes. Cloudflare OS records every resource the agent interacts with, attaching this record to the agent’s workspace. When someone views the workspace or its outputs, Gatekeepers verify access to the observed resources. This prevents sensitive data from leaking through generated outputs or outbound requests, effectively following the data after it’s been accessed. As Emerge Digital explains, most governance models authorize requests; this model tracks the data itself.

Component Comparison: Dynamic Workers, Durable Object Facets, and AI Gateway

Building an app in Cloudflare OS involves writing both client and server code. The server runs as a Dynamic Worker, instantiated as a Durable Object with its own SQLite database. Each app’s database is isolated, preventing contention and enabling deterministic recovery. Dynamic Workers use lightweight V8 isolates, which load about 100 times faster and consume a tenth of the memory compared to containers, according to Cloudflare’s own benchmarks. The Durable Object pattern involves a supervisor Durable Object that loads the agent’s code and then instantiates a dedicated Durable Object class as a “facet” with its own database. This per-instance database pattern echoes approaches seen in our analysis of SQLite-based durable AI workflows.

The main components and their roles are summarized below:

Component	What it does	Why it matters
Agent Workspace	Browser-based sessions with persistent state, isolated runtime, curated context, and reusable skills	Enables non-developers to research, create documents, spreadsheets, and apps without local setup
Gatekeeper	Cloudflare Worker mediating access to external systems, managing credentials, and enforcing policies	Provides least-privilege access; agents start with no access and only get what’s needed
Observation log	Tracks every resource an agent observes, controlling downstream sharing and requests	Prevents data leaks by ensuring only authorized access to observed resources
Dynamic Worker	Loads server code into a V8 isolate with outbound networking disabled	Offers fast, disposable isolated runtimes; claims load 100x faster and use 1/10th memory of containers
Durable Object Facet	Creates a dedicated SQLite database for each app instance	Provides durable, isolated state per app, separate from the supervisor
Cap’n Web RPC	Open-source RPC protocol between browser and server	Enables code reuse; tools built by humans can be used by agents and vice versa
AI Gateway	Routes inference calls, supports model selection, budgets, and attribution	Gives control over model usage and costs across the organization
MCP Server Portals	Connects to existing MCP servers	Reuses standard protocols for tool access across enterprise systems

Comparing these components to other enterprise agent platforms reveals a strategic divergence. While AWS’s Bedrock AgentCore launched in October 2025 and Google’s Vertex AI Gemini in April 2026, Cloudflare’s open-source OS emphasizes ownership and transparency, its code on GitHub, running in your account, with no published platform fee. AWS and Google offer portable agent code but proprietary control planes; Cloudflare inverts this approach, prioritizing open, auditable code.

Cost Control Through AI Gateway

Cost management is central. Every inference request routes through Cloudflare AI Gateway, allowing organizations to set model budgets, rate limits, and attribution. This enables fine-grained control over inference spending, aligning costs with organizational units like teams or workspaces. Cloudflare itself uses AI Gateway to filter, log, and audit inference interactions, applying Data Loss Prevention rules to prevent sensitive datasets from leaving the network.

Another cost lever involves transforming deterministic workflows into scheduled or on-demand code. This avoids re-running inference sessions for fixed sequences. For example, Cloudflare’s CIO recounts how their initial morning report burned thousands of tokens daily by re-computing the same analysis. The improved version generates code that runs once, then executes deterministically, reducing token expenditure and improving efficiency. This approach offers genuine cost savings, beyond simple routing adjustments.

Why It Matters: The Enterprise Agent Gap

Security gaps in enterprise AI agents are well-documented. A VentureBeat Pulse survey of 107 enterprises found that 54% experienced agent-related incidents or near misses. Only 32% give each agent a scoped identity, and 69% share credentials across agents. Organizations with credential sharing see incident rates of 63.5%, compared to 40.9% for those with scoped agents. Just 30% isolate high-risk agents in sandboxes.

An OutSystems 2026 State of AI Development report, commissioned from a third party, surveyed nearly 1,900 IT leaders globally. It found that 96% are running AI agents, yet only 12% can govern them effectively. Cloudflare OS aims to close this gap by providing scoped capabilities, resource tracking, and governance tools that address the core security and management challenges.

Its design responds directly to these issues. The capability-binding model prevents credential theft; the observation log contains data exfiltration risk; and the AI Gateway enforces governance and cost controls. While unproven outside Cloudflare, these mechanisms target critical enterprise failure points.

Supporting existing MCP servers via MCP Server Portals, Cloudflare aligns with the standard for tool access, adopted by industry leaders like AWS, Google, and Microsoft. The broader enterprise challenge remains organizational: whether companies have the context, identity, and data boundaries to leverage these tools effectively.

Trade-offs and Limitations

It’s essential to distinguish Cloudflare’s claims from independent verification. The internal adoption figures (thousands of employees using Cloudflare OS daily since May) are vendor-reported. Performance claims (loading 100x faster and using 1/10th memory of containers) come from Cloudflare’s own engineering posts without independent benchmarks. No outside case studies exist yet.

The platform’s maturity is still evolving. Both Dynamic Workers and Durable Object Facets are in open beta with no GA date announced as of August 2026. The repository describes the project as in early access, with many rough edges. This is typical for a new open-source project but warrants caution for production use.

Lock-in is another concern. Cloudflare’s code is auditable, but it assumes use of Workers, Durable Objects, and Access. Moving off Cloudflare requires rewriting. A managed version is on the roadmap; if it ships, the platform will resemble proprietary offerings from AWS and Google, narrowing the advantage of self-hosting.

Finally, self-hosting open-source infrastructure entails ongoing maintenance, upgrades, security patches, configuration, and integration. Cloudflare’s partners, Presidio and Happy Cog, offer support, indicating the platform isn’t turnkey. It also presumes organizations have curated context, terminology, and data classifications, without which the runtime alone offers limited value.

Practical Takeaways for Engineering Teams

If evaluating Cloudflare OS, focus on its architecture rather than immediate deployment. The core component (the isolated Dynamic Worker and Durable Object with its own SQLite database) offers a scalable way to run many small, stateful apps without containers. Prototype this first to understand operational impact.

Design for least privilege from the start. Use the capability-binding model to scope access tightly. Plan Gatekeepers to grant only necessary resources, with policies that mask or limit data as needed.
Build your context layer. Cloudflare OS provides the workspace, not your data. Curate machine-readable context, terminology, and skills before deploying agents.
Use AI Gateway for routing and budgets, not just cost control. Attribute inference calls, set limits, and route routine jobs to cheaper models. Reserve expensive models for critical reasoning.
Convert deterministic workflows into code. The most effective cost control is turning repeatable jobs into scheduled or on-demand code, avoiding unnecessary inference runs.
Monitor beta-to-GA progress. Dynamic Workers and Durable Object Facets are in open beta. Avoid critical workloads without a fallback plan.
Plan for self-hosting. You own upgrades and support. If you lack resources, consider partners or wait for managed offerings.

For a broader comparison of enterprise agent platforms on governance and cost, see Emerge Digital’s three-cloud comparison. And for security insights, the VentureBeat Pulse survey remains the clearest source. The architecture landscape is largely settled; organizational readiness remains the key open question.

Sources and References

Sources cited while researching and writing this article: