MCP Connects the Tool. Who Controls the Data?

Cloudflare OS is most useful as a policy-layer experiment, not as an operating-system label.

MCP can describe how an agent reaches a tool. Cloudflare OS uses service-specific Gatekeepers to govern agents' and apps' access to external services, including authorization, credential isolation, records of reads and actions, and approval for side effects. A production team still needs to test whether data can reach an unapproved service, whether a denial survives retries and subagent handoffs, and what evidence is required before an irreversible action.

I would test five failure paths before adopting this design:

1. Give the agent only the fields required for the task.
2. Try to move data from one permitted app into an unpermitted outbound app.
3. Repeat a denied request through retries, a different tool, and a different subagent.
4. Require a separate gate and attached evidence before sending, paying, deleting, or publishing.
5. Remove Workers and measure which policies, logs, and applications remain portable.

Cloudflare OS is still early access. Cloudflare explicitly describes rough edges, and production documentation for independent workerd deployment is still coming. That makes it a useful architecture to pressure-test, not a finished production answer.

Sources: Cloudflare announcement and public repository.