Cloudflare OS makes the sandbox the product, and the document the unit of isolation

The unit of isolation here is not the user and not the application. It is the document. A document editor running under Cloudflare OS spins up a separate instance in a separate sandbox for each document, and Cloudflare calls each one a Gadget ^[3]. Access control sits at the boundary of that instance rather than inside the code, so the platform decides who can reach a Gadget at all, and lead architect Kenton Varda argues a Gadget cannot leak itself even to an attacker who already holds other Gadgets built from the same app ^[4]. Sharing is checked the same way: Varda wrote on Hacker News that when you share a Gadget, the system verifies the recipient has direct permission to each connected resource, so a bug in the Gadget cannot hand anyone access they did not already hold ^[9].

That is the whole argument behind Varda's claim that a security team can let non-technical staff generate their own software and still sleep ^[2]. Nobody has to read the generated code. The reviewable surface is the grant list.

The prior state at Cloudflare is what makes the design legible. According to CIO Sam Rhea, employees were pushing to deploy unvetted generative AI workflows to build bespoke SuperApps, and those scripts wanted elevated administrative access plus production API tokens across dozens of internal systems of record ^[10]. Cloudflare's stopgap was a human-staffed "magic AI email" alias used to catalogue where routine work was getting stuck ^[11], and the triage produced a specific finding: off-the-shelf agent harnesses are fine at boilerplate software engineering, while knowledge workflows need strict context management, deterministic execution, and permission isolation that changes per task ^[12]. Gatekeepers are the answer to the third of those. They scope access to named resources, mask sensitive database columns, apply role-based rate limits, and require human approval before destructive side effects, with agents starting at zero ambient permissions ^[7]. InfoQ contrasts this with typical Model Context Protocol connections, whose implementations often grant broad ambient access ^[8].

On the adoption figures, Rhea's number is more than 4,000 custom business tools built by non-technical staff inside 30 days ^[14], which is roughly 133 a day ^[15], against internal use dating from May 2026 ^[13]. What a "custom business tool" is remains undefined in the material, and since a Gadget is instantiated per document, the count sits somewhere between an application tally and a document tally. That distinction matters to anyone using the figure to size their own rollout.

Two things the release does not close. InfoQ appends its own note that other risk vectors still apply, including misconfigured Gatekeeper grants ^[16], which puts the blast radius on whoever administers capabilities. And because every user runs a modifiable copy of the code ^[5], the material describes no mechanism for pushing a fix into copies that have already diverged.