2026-08-24
每日一文 · 长文精读
Cloudflare OS: Cloudflare's Open-Source Corporate AI Platform Built on a Capability-Based Model
Cloudflare OS：基于能力模型的Cloudflare开源企业AI平台
作者：Bruno Couriol · InfoQ 原文
摘要：Cloudflare 开源了 Cloudflare OS，这是一个基于能力模型的企业级 AI 平台。它允许团队在安全沙箱中构建定制化工作软件，自动执行重复性工作流，并通过“门控”系统实现细粒度权限控制。文章详细介绍了其技术架构、隔离机制以及内部使用效果，并引发了关于企业 AI 平台与现有生态整合的讨论。
Cloudflare recently open-sourced Cloudflare OS on GitHub.
Cloudflare 最近在 GitHub 上开源了 Cloudflare OS。
Cloudflare OS allows enterprise teams to output work artifacts grounded in enterprise knowledge, know-how, and provisioned connectors, automate repetitive workflows with optimized token cost (with AI assistance only where needed), and build personal, shareable, customizable work software that caters to specific, complex use cases within a secure sandboxed model.
Cloudflare OS 允许企业团队输出基于企业知识、专有技术和已配置连接器的工作成果，以优化的令牌成本自动执行重复工作流（仅在需要时提供 AI 辅助），并在安全沙箱模型中构建可满足特定复杂用例的个人化、可共享和可定制的工作软件。
The underlying capability-based model can be used to enforce enterprise policies.
底层基于能力的模型可用于强制执行企业策略。
Lead architect Kenton Varda explained what is a massive, multi-faceted release in a concise post:
首席架构师 Kenton Varda 在一篇简洁的帖子中解释了这一大规模、多方面的发布：
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
今天我们发布了 Cloudflare OS，一个带有连接器的聊天机器人，就像其他所有科技公司正在做的一样。
[…] Except actually, it’s different.
[…] 但实际上，它有所不同。
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that […] a company’s security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
这是一个真正的个人应用氛围编码平台，其沙箱如此安全，以至于公司的安全团队可以放心地授予非技术用户权限进行氛围编码，然后安然入睡。
How is that possible?
这怎么可能呢？
[…] For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one “Gadget”).
[…] 例如，如果你有一个文档编辑器应用，每个文档都作为该应用的一个独立实例运行，在一个独立的沙箱中（一个“Gadget”）。
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all.
这意味着两件事，我认为都是大事：1. 平台可以通过控制谁可以访问 Gadget 来管理所有访问控制。
There is no way the Gadget can accidentally leak itself to an attacker – even an attacker who has access to other Gadgets based on the same app [Ed. note: other risk vectors may apply, including misconfigured Gatekeeper capability grants].
Gadget 不可能意外地将自身泄露给攻击者——即使是能够访问基于同一应用的其他 Gadget 的攻击者也不行[编者注：其他风险因素可能适用，包括配置错误的门控能力授予]。
2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
2. 由于每个人都在运行自己的代码副本，每个人都可以自由修改自己的代码副本。
Think about #2 a bit more.
再想一想第 2 点。
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
如果你在使用软件时想要一个新功能，只需提示你的代理添加它，会怎样？
This doesn’t work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
这在云软件即服务模型中行不通，因为你没有运行自己的应用副本。
[…] AI has changed that.
[…] AI 改变了这一点。
Now you just ask the agent […]
现在你只需问代理 […]
And it is so fun.
而且这非常有趣。
The project reportedly emerged directly from Cloudflare’s internal operational scaling challenges.
据报道，该项目直接源于 Cloudflare 的内部运营扩展挑战。
Chief Information Officer Sam Rhea previously reported that employees were seeking to rapidly deploy unvetted generative AI workflows to create bespoke “SuperApps”.
首席信息官 Sam Rhea 此前报告称，员工们试图快速部署未经审查的生成式 AI 工作流，以创建定制的“超级应用”。
These scripts required elevated administrative access and direct production API tokens across dozens of internal systems of record.
这些脚本需要提升的管理员权限和跨数十个内部记录系统的直接生产 API 令牌。
To channel this demand without compromising security boundaries, Cloudflare initially operated a human-staffed “magic AI email” alias to catalog routine operational friction points.
为了在不破坏安全边界的情况下引导这一需求，Cloudflare 最初设立了一个由人工运营的“神奇 AI 邮箱”别名，用于记录日常操作痛点。
This triage revealed that while off-the-shelf agent harnesses excel at boilerplate software engineering, traditional knowledge workflows require strict context management, deterministic task execution, and dynamic permission isolation.
这种分类显示，虽然现成的代理工具在模板化软件工程方面表现出色，但传统的知识工作流需要严格的上下文管理、确定性的任务执行和动态权限隔离。
Rather than running centralized, multi-tenant Software-as-a-Service (SaaS) applications, Cloudflare OS gives each user their own copy of the application.
Cloudflare OS 不是运行集中式、多租户的软件即服务（SaaS）应用，而是为每个用户提供自己的应用副本。
Whenever a user prompts the system to generate a document, dashboard, or data view, the runtime instantiates a dedicated, isolated app instance within fine-grained V8 isolates managed by Cloudflare’s open-source workerd runtime and Dynamic Workers.
每当用户提示系统生成文档、仪表盘或数据视图时，运行时会在由 Cloudflare 开源 workerd 运行时和 Dynamic Workers 管理的细粒度 V8 隔离区中实例化一个专用、隔离的应用实例。
Each user can use generative AI to modify the source code of their specific instance on the fly without risking cross-tenant data leakage or introducing vulnerabilities into shared environments.
每个用户可以使用生成式 AI 动态修改其特定实例的源代码，而无需担心跨租户数据泄露或将漏洞引入共享环境。
Secure access to resources is governed by a capability-based security model that Cloudflare termed “Gatekeepers”.
对资源的安全访问由 Cloudflare 称为“门控”的基于能力的安全模型管理。
Unlike standard Model Context Protocol (MCP) connections whose implementation often provide ambient, broad access to systems and resources, Gatekeepers strictly scope access to designated resources, mask sensitive database columns, apply role-based rate limits, and mandate human approvals before executing destructive side effects.
与标准模型上下文协议（MCP）连接不同（其实现通常提供对环境、对系统和资源的广泛访问），门控严格将访问范围限定于指定资源，屏蔽敏感数据库列，应用基于角色的速率限制，并在执行破坏性副作用之前强制要求人工审批。
Agents start in a zero-trust state with zero ambient permissions.
代理以零信任状态启动，零环境权限。
Kenton further explained on Hacker News:
Kenton 在 Hacker News 上进一步解释道：
When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system).
当你共享一个 Gadget 时，我们会验证与你共享的每个人是否也拥有直接权限来访问它所连接的每个资源（通过门控系统）。
Hence, no security bug in the Gadget itself could accidentally grant people access to things they don’t already have.
因此，Gadget 本身的任何安全漏洞都不会意外地授予人们访问他们原本没有权限的资源。
The release article mentions that Cloudflare employees have used Cloudflare OS since May 2026, reporting significant productivity gains.
发布文章提到，Cloudflare 员工自 2026 年 5 月起已使用 Cloudflare OS，并报告了显著的生产力提升。
According to Rhea, non-technical staff built more than 4,000 custom business tools within 30 days, while sales teams recovered an estimated 10,000 hours of manual data aggregation for territory planning and pipeline analysis.
据 Rhea 称，非技术员工在 30 天内构建了超过 4,000 个自定义业务工具，而销售团队则恢复了大约 10,000 小时的手动数据汇总用于区域规划和管道分析。
Engineering teams now use the “Cloudflare Engineering Codex” (a machine-readable policy repository).
工程团队现在使用“Cloudflare 工程法典”（一个机器可读的策略仓库）。
Automated review agents evaluated pull requests and architecture designs against the Codex, flagging nearly 250,000 potential bugs, blocking 16,000 non-compliant merges, and catching roughly 600 architectural defects prior to implementation.
自动化审查代理根据法典评估拉取请求和架构设计，标记了近 250,000 个潜在错误，阻止了 16,000 次不合规合并，并在实施前发现了大约 600 个架构缺陷。
The release generated widespread technical debate across developer communities.
此次发布在开发者社区中引发了广泛的技术讨论。
Varda defended calling the product an OS, asserting that the platform behaves as an operating system by arbitrating compute workloads, isolating processes, and enforcing capability-based security boundaries for non-technical software authors.
Varda 为将产品称为操作系统进行了辩护，声称该平台通过仲裁计算工作负载、隔离进程以及为非技术软件作者执行基于能力的安全边界，表现得像一个操作系统。
Jeremy Morrell published a blog post using the term internal corporate platforms to describe the need for enterprise-grade secure collaboration and productivity AI tools for employees, in a similar way that internal developer platforms target developers in a company.
Jeremy Morrell 发表了一篇博客文章，使用“内部企业平台”一词来描述为员工提供企业级安全协作和生产力 AI 工具的需求，类似于内部开发者平台面向公司开发者的方式。
Commenter masterj, while praising the capability model, questioned whether standalone agent workspaces would fare well against native ecosystem integrations from established productivity suites:
评论者 masterj 在赞扬能力模型的同时，质疑独立的代理工作空间能否在与成熟生产力套件的原生生态系统集成中表现出色：
阅读理解
1. What is the primary security mechanism used by Cloudflare OS to control access to resources?
2. What advantage does Cloudflare OS provide by giving each user their own copy of the application?
3. Which of the following best describes the reported productivity gains from using Cloudflare OS?