Why we built an internal OS for AI work
About six months ago, a member of our sales organization asked me for API keys. Plural. They had used AI to build what they called a SuperApp for our go-to-market teams, and all they needed was production access to roughly a dozen systems of record plus admin permissions on a deployment pipeline.
That request marked a turning point. Cloudflare had spent 2025 being cautious with AI: informational chat apps and some boilerplate code assistance, but nothing that changed how work actually happened. Then, in a matter of days late last year, better models and more capable harnesses shifted the picture. AI agents could do things. Hundreds of employees across technical and non-technical roles spent the quiet holiday weeks experimenting.
The salesperson was the first of many who wanted to use these tools to transform their day-to-day work. We had an obligation to enable them — and an equal obligation to keep our systems, internal data, and customer data safe. Over the following months, we built a platform to do exactly that. We call it Cloudflare OS.
We started by assembling off-the-shelf pieces from our own Developer and Zero Trust platforms, including Cloudflare Workers and Access. As we learned more, we added custom services for this new way of working. Since many of you likely face the same challenge, we are now sharing what we built. This post covers our internal journey: the principles we set, how we piloted, what we built for engineers and non-engineers, and how we created champions across the org.
Ground rules for AI adoption
Cloudflare’s CTO and I sketched out what had to be true for AI adoption, then invited leaders from across the company to refine it. Five principles emerged.
1) AI must help us spend more time with customers. We do not use AI for its own sake. Teams start by defining their “jobs to be done” — pain points or bottlenecks in serving customers — then find the right tool.
2) Everyone deserves superpowers. AI writes code well, and the first action-capable tools lived in developer interfaces: command lines, editors, terminals, Git. That excludes large parts of our workforce. Employees should bring their subject matter expertise to an intuitive platform, not learn developer tooling first.
3) The human owns the output. AI is a tool and toolmaker, not a team member. Humans define quality standards and testing for AI output. The same applies to agents: whoever ships an agent owns its results, and if they leave, their manager inherits that responsibility as they would any workflow.
4) Organizational context matters more than the model. Workflows and agents need to know about Cloudflare. Technology investment had to be paired with a curated, canonical context layer.
5) AI never grants more permission than you already have. Everyone at Cloudflare has a scoped view of internal data, segmented by device, role, and region. That segmentation must hold when I direct an AI agent to interact with the same data. If I share an agent, it should reflect each viewer’s permissions, not mine.
Start where your people work
We ran two parallel programs: one for engineers, one for everyone else.
Engineers need guardrails, not just speed
AI made our engineers faster — faster than our review process could absorb. Anyone could write bad code quickly, so we built better protections.
We created the Cloudflare Engineering Codex: an authoritative, opinionated guide to our principles and practices. Unlike policies that say what you cannot do, a Codex says what you should do. Every part of our codebase has a domain owner accountable for quality there.
That context layer spans the entire development lifecycle. One agent reviews every Merge Request against Codex requirements. Another reviews technical designs before implementation. A third reviews incident reports. In four months, those agents flagged nearly 250,000 potential problems, blocked 16,000 merges, and caught architectural issues in almost 600 designs before code was written. Engineering detail is covered in Timo’s post on AI Code Review. We are now focusing on tools that let engineers define the evaluation loops for their own agents’ output.
The magic email alias test
Our first attempt for non-engineers was a mistake. We handed them the same developer harnesses with friendlier interfaces. Engineers can clone a repository, add an AGENTS.md file, and point the harness at the work. But those harnesses map poorly to knowledge work that produces one-off outputs and touches dozens of systems of record. When everyone gets a code-writing workspace, you end up with far more code than you need — a flood of “vibe coded” apps searching for problems.
So we worked backwards. We told everyone they could email work they did not want to do to a “magic AI bot” that would respond with the output. In reality, a small team staffed the alias, using AI tools to complete the requests. People are less eager to send spontaneous coding ideas to an automated system, but very willing to offload work they dislike. Over hundreds, then thousands, of sessions, we identified the mundane tasks employees wanted automated.
We triaged manually and spotted patterns: recurring skills, context files, data connections, and output types. Once cataloged, we could automate responses to the alias.
We were deeply motivated to stop staffing that service — it was miserable. But we continued the manual work until we captured enough common “jobs to be done” to give teams a headstart. Then we built the platform where they could run those workflows safely themselves.
Cloudflare OS: a browser-based workspace
The first version of Cloudflare OS was a simple harness running in a container on Cloudflare’s infrastructure. Users authenticate through Cloudflare Zero Trust in a web browser, then run the skill files and workflows we collected during the magic email phase. Everything happens in the browser — no local configuration. New sales team members told us they could automate work within days of joining that would have taken weeks at their previous employers.
Users could close their laptop and step away while work ran in the cloud. This design also serves security: an ephemeral cloud environment only sees the data introduced into the session, unlike a local harness that could reach anything on the laptop. Our Security team has audit visibility and network control, including filtering where the environment can connect.
To get work done, users run skill files derived from common workflows we identified across departments. Company context and skills from the magic email phase become executable with one click. Output — like a technical architecture document or slide deck — renders in a side panel and can be shared with teammates.
Data access through MCP. Cloudflare OS connects to systems of record through our Model Context Protocol (MCP) Portal. MCP is a framework for connecting AI tools to systems of record, telling the tool what data and operations exist. User sessions are scoped to their existing permission set in each system.
We build and deploy our own MCP server for each system of record, even when a native version exists. Our own implementations let us layer on controls like rate limits by role or region. Building them on Cloudflare Workers keeps the maintenance burden near zero.
Inference with guardrails. All AI inference from Cloudflare OS routes through our AI Gateway, letting us filter, log, and audit interactions. We reuse Data Loss Prevention rules from our Secure Web Gateway to block certain datasets from ever reaching a provider. AI Gateway also controls model usage — not every user needs max thinking mode on the latest frontier model, and we do not want anyone spending $20 per hour to summarize their inbox. We gate models by role and steer autonomous use cases, like scheduled skill file runs, toward more efficient models.
From skill files to deterministic agents
Cloudflare OS originally gave teams an AI workspace where users could run skill files and their own workflows. The catch: every skill file executed kicked off a token-hungry inference session. But much of the work we do is mostly deterministic — a sequence of steps with some inference (or human judgment) in the right places. We don’t need AI to always be a tool as much as we need AI to be a toolmaker.
Today’s update to Cloudflare OS addresses that directly. Users can now describe a workflow in natural language, have an AI agent create the code to power that workflow, and run agents on demand, on a schedule, or triggered from an event. Rather than building one-size-fits-all agents to share across the organization, every team member gets the ability to create secure, isolated-by-default applications.
A concrete example: the IT help desk
Consider how my team supports Cloudflare’s own employees with hardware and software — provisioning, debugging, offboarding — all managed through a classic ticket queue.
Every morning I want to review open ticket queues and metrics around how well we’re serving internal customers. Before Cloudflare OS, that meant manual work: downloading CSVs, importing them into Google Sheets to build charts, and clicking through each ticket that arrived overnight. Time-intensive, and it created redundant data outside our system of record.
With Cloudflare OS v1, I ran this as a skill file connected to the MCP server for our ticketing software. Safer and less manual, but I was burning thousands of tokens each morning recreating a report that was mostly the same — plus more tokens triaging and drafting responses to overnight tickets.
Cloudflare OS v2 handles this automatically. I described the charts I want to view; an AI agent wrote the code powering them, alongside a secure connection to the dataset that uses a service we call a gatekeeper. That gatekeeper handles the consistent queries my agent makes, scoping down context for the app without any API key management.
When inference is actually needed, I can embed it directly into the application. I built options to draft AI responses to incoming tickets, review them, and send them — all within a secured workspace requiring no integration or deployment pipeline management.
Sharing the agent with others works cleanly too: each person authenticates with their own permissions through the same gatekeepers, so data boundaries are never crossed. And loading the initial report burns exactly zero tokens.
Champions, interns, and measurable wins
The platform alone wasn’t enough — we needed to enable people to use it. Instead of hiring a dedicated AI team, we identified early adopters across roles and made them champions for their peers. That included a sales leader in London, a solutions engineer in Texas, an investor relations leader in Portugal, a business development team member in Japan, and a Sales Ops leader in the US, each asked to partner with their teams on rethinking their work.
Embedding interns into established teams also worked well. We announced a goal of welcoming 1,111 interns this year; many who joined are working inside departments with a simple mandate: make this team an all-star team by equipping them with our AI tools.
The results have been striking. Thousands of Cloudflare team members use the platform every week, and daily active users have grown every single workday. In the last month alone, we estimate sales team members saved more than 10,000 hours previously spent on manual tasks like territory planning and proposal creation. In those same 30 days, users created over 4,000 apps and tools for specific challenges.
Still evolving
We’re far from done, but progress shows up daily. Last night someone shared a Cloudflare OS report that diagnosed a procurement bottleneck — work that would previously have meant days of manual spreadsheet crawling. This morning, an IT team member in Lisbon shared a workflow agent for tracking laptop replacements with someone on the finance team sitting nearby. Small acts of automation and knowledge sharing that compound.
We believe every team outside Cloudflare deserves the same superpowers. Cloudflare OS is now available to you, and we expect it to evolve quickly as we learn together. If you’d like to trade notes on what’s working — and what isn’t — with internal AI rollouts, let us know. We’d love to chat, human to human.
