Cloudflare OS makes data access part of the agent runtime

Cloudflare has open-sourced Cloudflare OS, a browser-based workspace for company agents, connected apps, documents, and workflows. Agents can use curated company context and skills, while apps run as isolated Workers with their own state. Why it matters: The strongest idea is not another chat interface. Cloudflare treats access as a runtime property: agents start with no access, credentials remain outside generated code, and policies can account for the resources an agent has already observed before it shares an output or makes an external request.

Try this: For one internal agent workflow, list the resources it may read, who may view each derived output, and which writes require approval. Then test whether a sensitive source can leak through a dashboard, shared workspace, or outbound tool call.