Every document is its own private app in Cloudflare's AI OS

What it does

Cloudflare OS is an AI productivity workspace that runs on Cloudflare Workers. It gives employees an agent chat interface preloaded with company knowledge, then lets them ask that agent to build small personal apps—called gadgets—that run inside private sandboxes. A security layer called Gatekeepers manages access to external services, enforcing narrow permissions and logging every action.

The interesting bit

The project treats every document like a private, modifiable instance of software rather than a file in a SaaS product. Because each gadget runs in its own sandbox, users can freely edit the underlying code—often written by AI—without risking data leaks to other tenants. Gatekeepers also solve the “human in the loop” bottleneck by simulating side effects so agents can keep working while humans approve actions asynchronously later.

Key highlights

• Every workspace is a Durable Object and every gadget runs in a Dynamic Worker Facet, making heavy use of Workers runtime features that were added specifically for this project.
• Gatekeepers wrap external APIs in a Cap'n Web interface, handle OAuth, and enforce capability-based security rather than traditional ACLs.
• The system is explicitly designed as a template for building “Your Company OS,” not as a product you run out of the box.
• The entire stack can run locally on the open-source workerd runtime or deploy to Cloudflare.
• It is already used daily by a large portion of Cloudflare’s internal workforce, from engineering to sales.

Caveats

• The project is in heavy development and the current release is explicitly labeled “early access” with many rough edges.
• Several integrations, such as GitHub and Google Docs, require separate configuration that the README mentions but does not fully detail.
• Gatekeepers are currently deployed alongside the OS instance; the vision of independent Gatekeeper services is not yet implemented.

Verdict

Worth exploring if you are running Workers at scale and want to see how the team that built the runtime thinks it should be used—especially if you are building internal AI tooling and prefer capability-based security over traditional IAM. Skip it if you need a polished, turnkey SaaS replacement today.