0:03I am Kenton, the lead engineer of Cloudflare Workers, a project that I started when I joined Cloudflare almost 10 years ago. But more recently, I've been leading development of something called Cloudflare OS. It's built on top of workers. That's what I'm going to talk about today. So what is Cloudflare OS? It's a chatbot with connectors like every other company. in the world is building right now here open ai to meta to the bagel shop down the street everyone seems to have their own agentic harness right um what can you do with it you can uh type in what you want the agent to do and the agent goes and does it so where it starts getting a little bit different um the way that the agents connect to external resources so you know you can tell it to go do things on github or or google docs or whatever um and it connects these through something called we call a gatekeeper and a gatekeeper is like an mcp server except with a bunch of extra stuff and that's sort of some of what i'm going to be talking about today but the the overall theme is sort of um well so the title of the talk cloud for os is an architecture of distrust is borrowed with permission from an art published by a fellow named Jamie Lord.

1:27This was published on the day Cloudflare OS came out a couple of months ago. And he basically asked his agent to write this article. And he told the agent, dig through the Cloudflare OS source code. And then write, and by the way, Cloudflare OS is completely open source, so you can do that. And he said to the agent, write an article about this, but make sure that it's... balanced that it's not like a puff piece or whatever and because he asked the agent to be balanced the agent ended up doing something that i find very funny which was um in order to it decided it had to come up with a criticism for each of the things that it was talking about and it decided to portray cloudflare os as a kafka -esque nightmare for agents the all these guardrails are uh it's like stifed to it and you know preventing it from doing whatever it is it wants to do and so i'm gonna have a few uh quotes from jamie's agent throughout the talk because i think they're very funny um don't bear with me here but um this particular quote sort of uh sums up um what we're trying to do so the agent said clowler thinks the agent cannot be trusted so they built so that its mistakes cannot matter and that's the general idea here is we want to build an agent harness where if the agent screws up or either the agent can't screw up, it's not able to screw up, or if it does screw up, you can just revert it and everything's fine.

2:59So let's talk about how we do that.

3:03So to start, in a typical agent harness, if you want it to connect to external things, usually you connect it to a bunch of MCP servers up front. that basically give it access to everything that you think you'll ever want it to access, sort of broad access to a lot of things. So it's connected to everything. And then you ask it to do specific things with your data. And so you might say, fix the typos in the Q3 plan. And now this agent is going to go off and like figure out which of its MCP servers might have the Q3 plan. It might search through your documents looking for the Q3 plan. It might accidentally find things that are secrets you didn't really... want it to look at right now it might find the wrong document because you have three different documents called q3 plan and you know q3 plan final q3 plan final b2 but most importantly i think is is not so much that it might see secrets but that when the agent has to do this it becomes less focused it has to spend tokens and essentially uh cognitive overhead thinking about where do i and finding it and seeing all the other stuff there, right?

4:16And if you can instead focus it on one thing, it actually gets smarter. So in Cloudflare OS, we do something different. Every new chat with an agent starts out in a clean sandbox that has access to nothing. Even though you've connected Cloudflare OS itself to all your services, each new chat, the agent can't immediately talk to any of them. And then we have to figure out which things you actually wanted the agent to talk to. And it turns out there's some clever ways you can do this. So whenever you are telling an agent or really a person that you want them to read a particular document, you don't normally tell them the title of the document. You normally send them a link, a link directly to the doc.

5:02And Cloudflare S can see these links and can figure out, oh, I know what kind of link that is. That's a link to a Google Doc or that's a link. link to a github repo or that's a link to a slack channel and um reverse that out and and then give the agent access to the specific thing because like obviously obviously if you put that link in there you want the agent to access that document so the harness gives the agent access to that document it gives it a what we call a capability this comes from capability-based security uh theory but and and what that physically looks like is so the agent has a javascript sandbox where it can do things by running snippets of javascript code and it actually just gets an object in that sandbox that has methods that allow it to read and write the document now jamie's agent says a capability is a leash um it's like trapping the agent into only um doing this one thing but like i said earlier that that leash is actually good a lot of the time because it avoids distractions you don't want your agent running off in some other direction and and we really do see like a lot of the time people are kind of shocked when they ask club fluoresce to do a menial task that they had previously done in other harnesses and it just like does it faster and smarter because it's not distracted by everything else in the world but it's true you don't

6:33always want an agent to only be able to access uh you know specific documents sometimes you do want to give it broader access and we support that too so um you can give an agent access to say your entire google drive if that's what you really need and here's an example this is uh the kind of thing you can build in cloudflare os um say we're building an agent that monitors a chat And when people ask the agent questions, it goes and digs through all the docs it has access to to find the answer to that question and respond. And so here, it is listening to the everyone chat. Someone asks a question. Someone says, how's Q3 going? And the agent goes and reads some documents.

7:20And the documents, in this case, it finds are documents that are public to all employees. And the everyone chat obviously contains all employees. And so this is fine, and the agent can reply.

7:34But if the agent happens to find another document that's a secret, in this case, the Q3 financials document, then we have a problem. So maybe this agent has access to more than everyone in the everyone chat might have access to, and we don't want people to be able to trick the agent into telling them secrets that they're not supposed to know. actually enforce this at the platform level because we see every read that it does on each of these docs and we can go and look at who has access to this doc who's on the the sharing settings and we can go look at who has access to the everyone chat well it's everyone and so then when we see oh this doc is not available to everyone we can block the agent from talking to the everyone chat subsequently whereas if the the question came from the finance team room which only contains people on the phone We're allowed to see the doc and then we can allow it to go through.

8:32Jamie's agent complains that this is a one-way door. So when the agent sees a secret, it becomes tainted with the knowledge of this secret. And now it is not allowed to do things that it could do before. And to be fair, this can lead to UX problems. Like this is something we're working on right now. Or, you know, sometimes people give an agent access to something that's sensitive and they didn't really realize it. And then all of a sudden their agent is not allowed to do a bunch of other things that they wanted. But there are a lot of ways we can solve this that range from boring ways to interesting ways. So a boring way is, you know, maybe there's an extra approval step. The human has to say, I promise this doesn't contain any secrets. Or maybe the security team has to check or, you know, something like that.

9:20A more interesting. The interesting idea that we're looking into is, what if when the agent goes to write to the Everyone channel and it's seen a secret, we don't just block it, but we actually rewind the agent back to the point in its thread where it read the secret document, and then we say, actually, you can't read that document. We return access denied instead, and then let the agent continue again. now it will go through the following steps again and eventually um post this reply to the everyone chat and it will be fine because it didn't have access and there's just there's so many interesting things like this that we can do because of the nature of uh ai agents and context windows and and the fact that you can just like erase their memory uh on a whim um it's it's really fun to go through this and i wish i could talk whole lot more about this but i have limited time so i'm going to move on so here's a problem we've all had um so you tell your agent to do something and then you walk away to go get coffee and 15 minutes later you come back you sit down you hope that your agent is done and you find out that actually it hasn't done a thing because the very first step that it tried to take required approval queue and you were not there to click allow and so

10:52um and this is like this is really annoying uh you have to essentially if you're going to have permissions on you have to sit there and babysit your agent and so you can't really multitask very well and even having a couple of agents quickly becomes difficult and so what do people inevitably end up doing is they say uh i'm i'm going to turn I'm just going to auto-allow everything. The agent doesn't screw up that often. Usually it does what I want. It only sometimes deletes the production database, and we'll deal with it.

11:26So in Cloudflare OS, we think there's another possible solution here. So in Cloudflare OS, when an agent starts doing things that affect the world, I like to say we fork reality and have the agent run in a separate timeline. where it can do whatever it wants, and only if the outcome is good do we merge that back into the main timeline, like merging a Git branch. And, okay, so how do I do that? So we can, through the gatekeepers, we can break down the actions that the agent is performing into read operations and write operations. The read operations, we just always allow them no approval needed because... A read doesn't really hurt anything unless it reveals a secret that the agent later writes somewhere else.

12:18And so if you're making sure that the writes are all properly authorized, then you don't have to approve the reads. And for the writes, what we do is we apply them to a simulated reality. So like if it's editing a Google Doc, we actually have a shadow copy. the doc that we maintain locally and the agent is actually editing that and if it tries to read back its edits it sees its edits as if they had happened but the actual google doc has not been affected yet and only at the end after the agent has done all the things it wants to do and queued them up and then you review them all at once and approve then everything applies now jamie's agent says the gatekeeper lies the agent on purpose creates a fabricated reality.

13:06And at this point, I started to get a little scared. I was like, do the agents really feel this way? Am I hurting the agent with all these guardrails? Like, Anthropic says we're not supposed to be mean to the AI anymore. Are they going to ban me? So I asked another agent, how do you really feel? And it pointed out that, you know, this is just this is just what a database does this is a database transaction uh at the you know you open a transaction you do some reads you do some writes um and then the the rights don't get seen by anyone else until you commit at the end and and i thought this was funny the the this agent said nobody thinks postgres is gaslighting a query anyway so of course, when you go and review this, you have a line item veto.

14:08You can cancel certain actions if you didn't actually want it to do those and then merge all the rest, easy enough. And so at this point, you might be thinking, Kenton, don't you know about the bitter lesson that, you know, maybe the agents are making mistakes this year, but by next year, they're going to be so smart that... The agent will always just do exactly what you wanted, and there won't be any need to review or approve anything.

14:39And to that I say, yes, they're going to get smarter. They might even, like, even if we had a perfectly smart AI, I think there's still the problem that the person prompting it is a human, and humans make mistakes. We often write prompts. that are ambiguous, or sometimes we just like don't think through the implications of what we're asking the agent to do. But what I don't want to see is I don't want to start seeing agents that second -guess people. I don't want my agent to say, wait, did you really want me to do that? Because that's dangerous. Like that, you know, probably it's going to stop there and I'm off getting coffee, right? And like that didn't help. But also like agents that second -guess you, sounds like misalignment like by definition right so no we don't want that we want the agent to do what we tell them and if we tell them clean up the shared drive and the agent deletes everything we just want to say oops then no actually back up that wasn't what i wanted that's gonna be important so um i seem to be talking faster than i did in my practice but that's all i have uh There's a lot more that I could talk about, but I only had 20 minutes.

15:58But one more thing I wanted to say. So you might be wondering, what is this software that I'm using for this? This doesn't look like a slide deck. Well, it actually is Cloudflare OS. The way that I made this presentation is I wrote a document explaining everything that I wanted to go over in my talk. And I gave it to Cloudflare OS. gave it to opus 5 .5 running in california and said implement this in javascript don't make slides don't use don't uh don't use a slide app don't use powerpoint just build something in javascript make it look like powerpoint is obsolete like this is the future right and this is what it built and i mean had i more time i probably could have made it even cooler but um but this is i mean this was shot from that document.

16:50So there's a thing you can do with Cloud4OS. All right, that's all I have for now. Thank you.