Cloudflare had been building something for months, out of the public eye. An internal platform where their employees, including those who aren't developers, describe workflows in natural language and an AI agent turns them into working applications. They called it Cloudflare OS. A few days ago, they open-sourced it.
The question many companies ask: how do I let my team build their own tools without someone on the security team losing sleep?
What a platform like this solves
The usual friction is familiar. Your operations team needs a dashboard that pulls data from three systems. They file a ticket. It goes through prioritization, development, QA, deployment. Three weeks later they have something that doesn't quite fit what they needed.
Cloudflare OS approaches this from a different angle. An employee describes what they need. The agent generates an application that runs in an isolated sandbox. Each document, each dashboard, each workflow is a separate instance with its own permissions. No traditional containers. They use V8 isolates that start in milliseconds and consume megabytes, not gigabytes.
The result: thousands of Cloudflare employees use the platform daily to create documents, automate repetitive tasks, and build small apps that visualize data. Without going through the traditional development funnel.
The security problem that blocks many companies
Letting non-technical people generate code with AI sounds good in theory. In practice, the security team sees nightmares: a poorly formulated prompt that exposes sensitive data, an app that connects to a production API without controls, an agent that writes to a database it shouldn't touch.
Cloudflare solved this with an explicit permissions model. Agents start with no access to anything. Every resource they need (files, APIs, databases) must be granted by the platform. Server code runs with outbound networking disabled by default. Client code runs in a sandboxed frame.
Kenton Varda, principal engineer at Cloudflare, summarized it this way: the sandbox is so secure that you can let the AI do whatever it wants without introducing serious vulnerabilities. The security team can give non-technical users permission to vibe-code and sleep at night.
What changes for your company
You don't need to use Cloudflare OS to apply the lesson. The principle is transferable:
Separate experimentation from production. Your team can build prototypes in isolated sandboxes where the cost of mistakes is low. When something works, you promote it to a controlled environment.
Define permissions before use cases. Before asking an agent to build something, decide which systems it can access and what it can modify. The security perimeter is defined at the start, not after the first incident.
Measure actual usage, not theoretical adoption. Cloudflare says thousands of employees use the platform daily. This isn't a lab experiment. If your team isn't using it after two weeks, the problem isn't the technology.
Start with reading, not writing. An agent that summarizes data from three systems into a dashboard is a safe first project. When your team trusts the result, you expand to agents that modify data.
At Luxion we help companies build this kind of internal platform: environments where your team can experiment with AI without the security team losing control. We start with one concrete case, set up the sandbox, define the permissions. Your team builds, you sleep soundly.