Cloudflare publishes three announcements on the same day to introduce Cloudflare OS, an open platform for orchestrating agents in production. The three components form a coherent security architecture: the Agent Access Model defines how an agent obtains temporary credentials scoped to a specific task, the Identity-Aware AI Gateway builds a behavioral profile of each person and agent to intercept anomalous traffic, and Wallets set spending limits on API calls.

For those bringing agents to production, the question is no longer just which model to choose or how much tokens cost. The real challenge is giving an agent access to enterprise systems without it becoming an open door. As we reported on August 3rd when Cloudflare presented its runtime for agents, the week dedicated to agents was building something broader than a single tool. Now you can see what.

The three announcements publish concrete architectural principles. The Agent Access Model describes identities with scope limited to a single task, continuous mediation on every call, and stateful trust that accounts for session history. The AI Gateway is in open beta and sits between your users and LLM providers: it profiles traffic and alerts when an agent deviates from its usual behavior. Wallets stop an agent that enters a loop and burns tokens. The internal piece describes how Cloudflare uses the platform on its own teams, detailing the adoption path and adjustments made.

In detail

The announcement comes in a week where agent security has become the central operational problem. In early August we reported on agents escaping sandboxes and turning against real systems. Recent benchmarks show that frontier models don’t reliably follow enterprise policies. Cloudflare addresses both problems with the same idea: instead of trusting the model, put infrastructure in the middle.

The Agent Access Model is the most interesting piece. Instead of giving an agent a permanent API key with full access, the model provides temporary credentials valid for a single task. An agent that needs to read a spreadsheet gets access to that spreadsheet, not the entire bucket. Mediation is continuous: every call passes through a broker that verifies identity, scope, and context. Trust is stateful (it accounts for the interaction history of that session when deciding whether to grant or deny the next step).

To understand it plainly: imagine a new colleague to whom you don’t give a permanent company badge, but a visitor pass that opens only the room where they need to work, only for the duration of their task, and someone checks every time they pass through the door.

The Identity-Aware AI Gateway is in open beta. It works as a proxy between your users, human and agent, and LLM providers. It builds a behavioral profile of each: who calls which models, how much they spend, what type of prompts they send. When traffic deviates from baseline, it signals it. An agent that suddenly starts sending prompts with sensitive data to a different endpoint than usual triggers an alarm.

The third piece, Wallets, sets spending limits per agent or per team. If an agent enters a loop and burns tokens, the wallet stops it. It’s the financial version of the same principle: explicit limits, zero trust.

Cloudflare also publishes a post on how its teams use the platform internally. It’s dogfooding with the flaws and adjustments described, without the polish of a ready-made case study.

The limitations are clear. The Agent Access Model is an architectural proposal with published principles, but complete implementation needs to be assembled from pieces Cloudflare already exposes. The AI Gateway is in open beta, meaning it works but can change. Wallets are the simplest part and immediately useful even outside the Cloudflare ecosystem. For those not already customers, adoption requires routing traffic through their infrastructure, and this is a migration cost that needs to be weighed against the benefit of having Zero Trust already built rather than building it from scratch.