Cloudflare open-sources a platform where agents start with no access at all

Cloudflare released the source for its internal agent workspace, in two repositories: a core and an example deployment. Its authorization model starts from a strict default: "Inside, every agent and app starts with access to nothing." An agent asks for a specific resource and generated code receives it as a typed capability binding, with the credential held outside the agent. "Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide."

Service-specific Workers called Gatekeepers mediate each external system, and the post gives a worked example: scope an agent to one repository, let it read issues but not source, mask fields, rate limit, and require approval before a merge. Cloudflare also records every resource an agent observes, and uses that log to decide both who may open the resulting work and whether the agent may make an outbound request at all. The argument for it is stated directly: knowing which tools an agent can call does not tell you which resources it has seen, and "authorization has to account for where the data can go next."

Why it matters: those two mechanisms, default-deny outbound networking and provenance-aware policy, are precisely what item 1's chain walks through. This is a vendor launch with no measurements in it, and its claim that thousands of Cloudflare employees use it daily is unverified here. The difference from a changelog is that the code ships, so the security model is something a skeptical reader can deploy and test.