The agent gets power in typed handles.

Cloudflare OS is trending because its security model is concrete: every agent and app starts with access to nothing. The code gets power only through capabilities that are explicitly provided. 1

Those capabilities are not passwords handed to the model. A Gatekeeper holds the OAuth credential, understands the external service, enforces policy, records what was read, and mediates externally visible side effects. The generated code sees a typed binding such as env.PROJECT. 1

The runtime adds two more boundaries: server code runs in a Dynamic Worker with global outbound networking disabled, and a Durable Object Facet gives each app its own SQLite database. 1

The useful mental model is least-privilege plumbing for agents. It can shrink the blast radius and preserve provenance; it does not prove that an agent's reasoning or requested action is correct. That last sentence is an inference from the access boundary the source describes, not a Cloudflare guarantee. 1