The enterprise AI brain, without the data leak: Cloudflare OS + Castform

Every CTO we talk to has run the same experiment. They gave a frontier model access to a slice of internal data, watched it produce something impressive in a demo, and then hit the wall: legal, security and compliance all wanted to know exactly what the model saw, where that data went, and who could reproduce it.

That wall is where most enterprise AI projects die. Not because the model was not smart enough, but because nobody could draw a defensible boundary around it.

On August 5, 2026, Cloudflare open sourced Cloudflare OS, and the boundary problem got a real answer. Pair it with Castform for the model layer and you get a company brain that runs in your own infrastructure, on weights you own, where everything an agent touches is granted, logged and revocable.

This is the architecture we are deploying for clients. Here is how it works, and why the security model is the interesting part.

The bottleneck was never the model

The industry spent three years optimizing for raw model capability. The actual blockers in a 500-person company are mundane:

• The agent needs the deployment runbook, which lives in a Notion page nobody has read since 2024.
• It needs to read GitHub issues but must never see source code.
• It needs to query the production database, but only the columns marketing is cleared for.
• And when someone shares the resulting dashboard with a contractor, the contractor must not inherit the data behind it.

None of that is a model problem. It is a context, execution and permissions problem. Cloudflare OS is built specifically for that layer, and Castform is built for the layer underneath it. They do not compete. One orchestrates the work, the other makes the reasoning cheap and specific to your domain.

Cloudflare OS: deny by default, at every layer

Cloudflare OS gives everyone in a company a browser-based agent workspace: agent sessions, persistent state, file outputs and a sandboxed code runtime, with no terminal and no developer expertise required. Employees describe work, agents do it, and the results can become real applications with a UI, server logic and a database.

The reason we are willing to put this in front of an enterprise security team is the permission model.

1. Agents start with nothing

Cloudflare's own words:

"Inside, every agent and app starts with access to nothing. An agent can ask for access to a specific resource, which you can grant or deny."

This is the inverse of the standard pattern, where you hand an agent an API key and hope the system prompt holds. Here, permissions arrive as typed capability bindings. Credentials never enter the generated code. The agent calls env.PROJECT.listIssues() and has no idea what token sits behind it, because it never sees one.

2. Gatekeepers enforce policy, not prompts

Gatekeepers are service-specific Workers that sit between the agent and every external system. They handle OAuth, credential storage, policy, audit logging, and any action with side effects.

What that buys you, again from the announcement:

"A Gatekeeper can give it access to a single repository, allow it to read issues but not source code, mask particular fields, apply rate limits, and require approval before merging a pull request."

Field-level masking and human approval gates, enforced in code, outside the model's reach. A jailbroken prompt does not get you past a Gatekeeper, because the Gatekeeper is not reading the prompt.

3. Observation tracking follows the data

This is the feature most people miss on first read, and it is the one that closes the leak your DLP tooling cannot see.

"Cloudflare OS records every resource agents observe. These observations remain attached to the agent and its work. When another person tries to open the workspace, interact with the agent, or view what it produced, Gatekeepers verify that person's access to the observed resources."

In practice: an analyst builds a dashboard from HR salary data, then shares it with a contractor. The contractor does not get the dashboard, because the contractor was never cleared for the source. Provenance travels with the output. Most homegrown RAG stacks have no answer to this at all.

4. The runtime is genuinely sandboxed

"Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser."

Neither side reaches the internet except through capabilities you explicitly provide. Agent-written code cannot phone home. Exfiltration through a generated fetch() call is not blocked by policy — it is unavailable at the runtime level.

5. Spend and model choice are governed centrally

All inference routes through Cloudflare AI Gateway. Every request is attributed to the person, team or workspace that made it, so administrators can see where inference spend is going and set budgets and rate limits, plus route tasks to different models by complexity and cost.

And the deployment story closes the loop: Cloudflare OS is open source, and you deploy it into your own Cloudflare account with your own Access policies, AI Gateway configuration, data and integrations. Nothing about this requires trusting a black-box SaaS with your internal systems.

Castform: the specialist model you actually own

Cloudflare OS is deliberately model-agnostic. That leaves an opening, because routing every internal task to a frontier API is both the most expensive and the least private option available.

Castform is a training platform for the other path. You point it at your existing corpus, agent traces and logs; it generates training data from them, runs supervised fine-tuning and reinforcement learning on open-weights base models, evaluates against composable reward functions, and hands you the weights.

Two properties make it the right partner for this architecture:

Small models get very good at narrow jobs. Castform's own published benchmark puts a fine-tuned 4B-parameter model well ahead of GPT-5.4 on a retrieval-agent task, at a fraction of the API cost. A 4B model is not going to write your next novel. It does not need to. It needs to route a support ticket, extract a clause, or decide which of your internal tools to call — and for that class of work a specialist trained on your traces beats a generalist that has never seen your systems.

You own the weights. Castform lets you export trained weights at any time and deploy them anywhere. Combined with a self-hosted Cloudflare OS deployment, your institutional knowledge is not sitting in a third party's fine-tuning tenant. It is in a file you control.

One caveat we tell every client up front: this is not RAG. Adding a document does not update the model. Knowledge that changes daily belongs in retrieval. Fine-tuning is for style, decisions, workflows and the edge cases your team keeps re-explaining. The right answer is almost always both.

The retrieval layer

Which is why the third piece is a database that does hybrid search natively. Neon's Lakebase Search extensions bring vector similarity and BM25 ranking into the same Postgres transaction, with indexes on object storage so they scale to zero and branch instantly. No separate vector store to sync, no drift between your app data and your embeddings.

We covered that stack in detail in our post on choosing a database for AI agents.

The reference architecture

Employee  ->  Cloudflare Access (identity boundary)
          ->  Agent Workspace (sandboxed runtime, org context + skills)
          ->  Gatekeepers  ->  GitHub / Jira / Salesforce / internal APIs
          ->  AI Gateway   ->  Castform 4B specialist  |  frontier model (escalation)
          ->  Neon Postgres (hybrid vector + BM25 retrieval)

Cheap specialist model for the high-volume path, frontier escalation for the hard cases, retrieval for anything that changes, and a permission boundary that holds at every hop.

Where Rather Labs comes in

This stack is powerful and it is not turnkey. The work that decides whether it succeeds is the unglamorous part: writing Gatekeepers that encode your actual access policy, mapping which systems agents may touch and under what conditions, curating organizational context that is worth trusting, building the training pipeline that turns your traces into a model that improves every month, and treating retraining as CI/CD rather than a one-off project.

That is architecture-through-production work, and it is what we do. More than 100 professionals across 13 countries, 80+ products delivered, six years building high-stakes systems. We have shipped security-critical infrastructure where mistakes are measured in millions, including smart contract systems audited by Coinspect, PeckShield and Runtime Verification. We bring the same posture to enterprise AI: deny by default, prove the boundary, then ship.

If you are evaluating how to give your company an AI brain without handing your data to someone else's model, the first question is not which model. It is which resources an agent should be able to observe, and who is allowed to see what it produces afterwards. Answer that and the rest of the stack mostly follows.

---

Rather Labs builds AI and blockchain products for companies that need them in production, not in a demo. If you are designing an enterprise agent platform and want a second opinion on the permission boundary, get in touch.