Cloudflare is the network that became a compute platform and then an agent platform, and the map reads it as strong where the agents run and moderate everywhere they store, move, and get governed. One layer strong (2B: open-weights inference on Cloudflare's own GPUs in 180-plus cities, one gateway to 70-plus models across 12-plus providers, and a generally available durable agent runtime with documented approval gates), eight moderate (0A, 0B and 0C for CPU compute, a network and R2 object storage, with no accelerator you can touch; 1A for edge databases and residency controls without a catalog; 1B for a vector index and open embedding models with the managed search in beta, 1C for queues and durable workflows without pipelines, 2A for manual containers and multi-tenant dispatch, 2C for a gateway over model calls and a firewall for large language model (LLM) endpoints, with the tool gateway and agent identity in beta), and one gap: no first-party application that runs a business process.
The capture is coupled and visible, and it sits in the substrate rather than the model. The models are open weights behind standard-shaped endpoints, the gateway is a broker the enterprise can replace, and the Workers code the enterprise writes runs on the Apache 2.0 workerd runtime anywhere; those read Delegated and Retained. Everything stateful reads Ceded: Durable Objects, Workflows, Vectorize, Containers, Queues, the Agents SDK's runtime (MIT code on a substrate that exists only on Cloudflare), the gateway's routing rules and guardrail settings, and the jurisdictions and policies written into Cloudflare's dashboards. Twenty-four components read Retained 1, Delegated 6, Ceded 17. The pattern is the hyperscalers' with the accelerator subtracted: Cloudflare owns its Layer 0 and rents none of it.
The buyer's trade: inference and agents in the same 330-city network their traffic already crosses, with no cluster to run and a model layer that lifts, in exchange for an agent substrate that doesn't, a data plane sized for applications rather than estates, and a governance plane whose tool-call gateway, agent identity, and traces are all in beta. Nearly everything that would move a cell has a date and a badge: AI Search, Pipelines, R2 Data Catalog, R2 SQL, Dynamic Workers, MCP Server Portals, WriteGuard, Agent Traces, Smart Placement, container autoscaling, pay per crawl, Wallets. Cloudflare ships to beta faster than any row on the map, and the instrument grades what has left it.
Layer-by-layer status: Layer 0A (CPU Compute You Can Size, GPUs You Can't Touch), Layer 0B (A Global Network You Can Buy, Not an AI Fabric), Layer 0C (R2, an S3-Compatible Store Not Built for AI Throughput), Layer 1A (Edge Databases and Residency Controls; Catalog in Beta), Layer 1B (Vectorize + Open Embedding and Rerank Models; Managed RAG in Beta), Layer 1C (Queues, Workflows, and Object Migration; Streaming Ingest and Iceberg in Beta), Layer 2A (Manual Containers from Durable Objects, Multi-Tenant Dispatch, and Jurisdictions; No Autoscaling, No GPU Plane), Layer 2B (Serverless Open-Model Inference + One Gateway to 70+ Models + Durable Agents on Every Edge), Layer 2C (Gateway Over Model Calls + Firewall for LLM Endpoints + Access for MCP Servers; Tool Gateway and Identity in Beta), Layer 3 (+1) (A Console for AI Traffic, Not an AI Application; the Agentic-Internet Surfaces Are in Beta).
Assessment framework: 4+1 Layer AI Infrastructure Model. Scoring model: Decision Authority Placement Model (DAPM) — Retained, Delegated, or Ceded. Published by The CTO Advisor LLC (DBA The Advisor Bench). Author: Keith Townsend. Date assessed: October 19, 2026. Version: v1.9 - 4+1 v3: Layer 0 Sub-Layers.
Cloudflare is the network that became a compute platform and then an agent platform, and the map reads it as strong where the agents run and moderate everywhere they store, move, and get governed. One layer strong (2B: open-weights inference on Cloudflare's own GPUs in 180-plus cities, one gateway to 70-plus models across 12-plus providers, and a generally available durable agent runtime with documented approval gates), eight moderate (0A, 0B and 0C for CPU compute, a network and R2 object storage, with no accelerator you can touch; 1A for edge databases and residency controls without a catalog; 1B for a vector index and open embedding models with the managed search in beta, 1C for queues and durable workflows without pipelines, 2A for manual containers and multi-tenant dispatch, 2C for a gateway over model calls and a firewall for large language model (LLM) endpoints, with the tool gateway and agent identity in beta), and one gap: no first-party application that runs a business process.
The capture is coupled and visible, and it sits in the substrate rather than the model. The models are open weights behind standard-shaped endpoints, the gateway is a broker the enterprise can replace, and the Workers code the enterprise writes runs on the Apache 2.0 workerd runtime anywhere; those read Delegated and Retained. Everything stateful reads Ceded: Durable Objects, Workflows, Vectorize, Containers, Queues, the Agents SDK's runtime (MIT code on a substrate that exists only on Cloudflare), the gateway's routing rules and guardrail settings, and the jurisdictions and policies written into Cloudflare's dashboards. Twenty-four components read Retained 1, Delegated 6, Ceded 17. The pattern is the hyperscalers' with the accelerator subtracted: Cloudflare owns its Layer 0 and rents none of it.
The buyer's trade: inference and agents in the same 330-city network their traffic already crosses, with no cluster to run and a model layer that lifts, in exchange for an agent substrate that doesn't, a data plane sized for applications rather than estates, and a governance plane whose tool-call gateway, agent identity, and traces are all in beta. Nearly everything that would move a cell has a date and a badge: AI Search, Pipelines, R2 Data Catalog, R2 SQL, Dynamic Workers, MCP Server Portals, WriteGuard, Agent Traces, Smart Placement, container autoscaling, pay per crawl, Wallets. Cloudflare ships to beta faster than any row on the map, and the instrument grades what has left it.
CPUs, accelerators, servers, integrated systems, OS and hypervisor, physical plant
Six container instance types from lite to standard-4, started from Durable Objects and billed in 10 millisecond increments, plus the Workers isolate runtime. Compute on Cloudflare's hosts, placed by Cloudflare: Ceded.
Cloudflare's inference fleet in 180+ cities is NVIDIA, and the Infire engine runs frontier open models across multiple H100s. The customer never sees, sizes or schedules a GPU.
Cloudflare sells compute the enterprise sizes without seeing a host: Workers on V8 isolates, Durable Objects, and Containers. Containers are generally available on the Workers Paid plan in six instance types from lite to standard-4, billed in 10 millisecond increments. What the enterprise can't buy is acceleration. Workers AI runs on Cloudflare-owned NVIDIA GPUs in more than 180 cities, but no GPU is exposed as a product: no instance, no container class, no reservation. The buyer gets a global substrate for CPU workloads, with inference as a service on top. The architect's concern is the half that's missing. The sub-layer's purpose names acceleration, and the accelerator fleet is invisible. Calibration: CoreWeave and the hyperscalers read strong on GPU compute the customer provisions; SAP moderate on self-service infrastructure without accelerated compute.
Cloudflare decides which city and host a Worker, Durable Object or container runs on; jurisdictions and location hints are configuration: vendor decides, visible, not overridable, Ceded. Portability: the containers and Workers run on Cloudflare's hosts, placed by Cloudflare, Ceded.
Ruled October 5, 2026: moderate on reading Layer 0 by the vendor's shape, the SAP precedent. Public evidence that moves the cell: a GPU instance, container class or reservation the customer administers.
Interconnects, switching and routing, network virtualization
The anycast fabric sold as connectivity: Magic WAN and Cloudflare Mesh (encrypted private networking for users, nodes, and agents). Cloudflare's fabric: Ceded. Workers VPC Networks is public beta and unscored.
Magic Transit puts the enterprise's networks behind Cloudflare's anycast network for DDoS mitigation and acceleration, with tunnel route priorities and BGP peering the enterprise configures. Network Interconnect links the enterprise's network to Cloudflare over direct fiber, a partner, or private circuits from cloud VPCs. Both are Enterprise-only.
Assessment pending
The network is the product: an anycast fabric in more than 330 cities that the enterprise buys as connectivity. Magic WAN and Cloudflare Mesh carry encrypted private networking for users, nodes and agents. Magic Transit puts the enterprise's networks behind the anycast network for distributed denial-of-service (DDoS) mitigation, with tunnel route priorities and Border Gateway Protocol (BGP) peering the enterprise configures. Network Interconnect links in over direct fiber, a partner or cloud circuits. The buyer gets a global wide area network (WAN) without building one. The architect's concern is that it's WAN networking, not an AI fabric. Nothing here joins accelerators. Calibration: Red Hat and VMware read moderate on networking that isn't an AI fabric; AWS's EFA and Azure's InfiniBand strong on fabrics built for collective traffic.
Cloudflare's anycast network decides routing for Magic WAN, Mesh and Transit traffic; the enterprise administers tunnels, routes and peering on top: vendor decides, visible, not overridable, Ceded. Portability: the network is Cloudflare's fabric, Ceded.
Named, not scored: Workers VPC Networks (public beta since April 14, 2026). Magic Transit and Network Interconnect are Enterprise-only.
Arrays, storage servers and software, front-end protocols: where the data sits
Object storage consumed through the S3 API with no egress fees, the substrate under AI Search, Pipelines, and the Iceberg catalog. A multi-vendor standard interface: Delegated.
Assessment pending
R2 is S3-compatible object storage with zero egress fees, the store under AI Search, Pipelines and the Iceberg catalog. R2 jurisdiction is a per-bucket setting, and location hints bound where data lands. The buyer gets durable, globally distributed storage with an open interface and no egress bill. The architect's concern is throughput. R2 is Cloudflare's only storage at this sub-layer, and nothing documents it for feeding accelerators. It's the store a lakehouse or an agent sits on, not one a training cluster reads from. Calibration: IBM Cloud and SAP read moderate on general-purpose storage; AWS and Azure strong on managed Lustre.
Ceded where the grade rests. R2's engine decides where object bytes sit and how they replicate, and jurisdictions and location hints bound it as configuration, not overrides: vendor decides, visible, not overridable, Ceded. Portability: R2 is consumed through the S3 API, a multi-vendor standard, Delegated.
The data itself, organized and governed: the Governance Catalog that Layer 2C queries
A managed database with SQLite semantics and SQLite3-compatible data, exportable as SQL. A managed service over an open engine: Delegated.
A global key-value store and per-object SQLite storage where agent state and memory persist. Cloudflare-bound managed services: Ceded.
An edge accelerator in front of a database the enterprise owns elsewhere; removable by connecting directly. Delegated.
Hostname-scoped regional request processing for Workers, per-bucket R2 jurisdiction, and region-bound Durable Objects. Cloudflare's controls, applied product by product: Ceded.
Nothing at this layer runs on accelerators.
With R2 at 0C, Cloudflare's 1A is databases and controls built for applications and agents. D1 is a serverless database with SQLite semantics and SQL export, Workers KV a global key-value store, and SQLite-backed Durable Objects carry the state agents persist into. Hyperdrive fronts the enterprise's own PostgreSQL and MySQL. Governance is location and access: Regional Services, R2 and Durable Object jurisdictions, and Access and Zero Trust policies, applied product by product. The architect's concern is the catalog. R2 Data Catalog is a managed Iceberg REST catalog in open beta, so it isn't scored, and table metadata still wouldn't be lineage or classification. 1A is graded on a catalog that classifies the data, and that's governance without classification: moderate. Calibration: Elastic and MongoDB read moderate on a durable store with access governance and no catalog.
Cloudflare's storage executes the jurisdictions, schemas and access rules the enterprise wrote, without inference from the data: code decides, visible, overridable, Retained. Portability: D1 over open SQLite and Hyperdrive read Delegated; Workers KV, Durable Object storage and the jurisdiction controls are Cloudflare-bound, Ceded.
Named, not scored: R2 Data Catalog and R2 SQL (open beta). Public evidence that moves the cell: a GA catalog carrying lineage, classification, policy or queryable governance metadata.
Low-latency retrieval for RAG — vector/hybrid search, context windows
The generally available vector database queried from Workers. Cloudflare's index: Ceded.
Open-weights models served in Cloudflare's network through the Workers AI binding and REST API. The enterprise can serve the same weights elsewhere and the vectors recompute: Delegated on the open-weights precedent.
The embedding and reranker models run on Workers AI's GPUs in Cloudflare's network; no customer-side dependency.
Retrieval on Cloudflare is assembled from primitives. Vectorize (generally available) is a managed vector index queried from Workers with metadata filtering and namespaces, up to 20 million vectors per index (doubled on August 4, 2026) at up to 1,536 dimensions, and Workers AI serves the open embedding models (BGE base, large, small, and m3; EmbeddingGemma; Qwen3 embeddings) and a BGE reranker that fill it, so the enterprise builds the pipeline: chunk in a Worker, embed on Workers AI, store in Vectorize, filter and query at request time, rerank in a second call. AI Search is the managed alternative: point it at an R2 bucket, a website, or uploaded files and it chunks, embeds, continuously re-indexes, and serves hybrid semantic-plus-keyword search through a Workers binding, a REST API, or a built-in Model Context Protocol (MCP) endpoint, with namespaces, metadata filters, custom domains, and Access protection; it's free within limits during its open beta, so it isn't scored. The buyer gets a vector store and embedding models at the edge, and a managed retrieval-augmented generation (RAG) service they can try but not yet rely on. The architect's concern is coverage, not the vector count. Vectorize is an index, not a retrieval estate: no lexical search, no hybrid fusion, no reranking stage, no permission-aware retrieval inside it; hybrid search exists only in the beta AI Search. Elastic and MongoDB carry no per-index cap and ship the whole pipeline. Embeddings made on Workers AI are made by open models the enterprise could serve elsewhere, so the space isn't captive to Cloudflare, only to the model. Calibration: Elastic, MongoDB, and Snowflake read strong on native hybrid retrieval estates; Mistral moderate on hosted libraries; Cohere moderate on frontier models plus a fixed-function bundle; AWS strong on a managed portfolio. Cloudflare is a vector index plus open models with the managed layer in beta. Moderate.
Low. Vectorize is Cloudflare's index and Ceded; the embedding and reranker models are open weights Cloudflare serves, Delegated on the open-weights precedent (the same models run anywhere, and the vectors recompute). The enterprise writes the pipeline, chooses the model, and composes the query: vendor decides at the index, visible, overridable, Delegated, the Elastic reading for a retrieval surface the enterprise configures end to end.
Watch-list, notes only, and this is what moves the cell: AI Search (open beta; hybrid search, automated indexing, MCP endpoint, namespaces; the August 6, 2026 post added sitemap-free discovery, custom domains, and Access protection). Public evidence that moves the cell: a GA badge on AI Search, or hybrid search and reranking inside Vectorize.
Move/transform data — ETL/ELT, lineage, cost-aware movement, KV cache tiering
Generally available queueing for event movement inside the platform. Cloudflare's service: Ceded.
Generally available durable execution engine running the enterprise's multi-step code, the orchestration primitive under Agents. Cloudflare's engine: Ceded. Dynamic Workflows is beta-dependent and unscored.
Bulk and on-demand migration into R2. One-way tools on Cloudflare's paper: Ceded.
Delivery of platform and Zero Trust logs to the enterprise's storage and SIEM at a cadence Cloudflare sets. Cloudflare's exporter: Ceded.
Nothing at this layer runs on accelerators.
Cloudflare moves data as events and code, not as pipelines. Queues (generally available) is a message queue between Workers with batching, retries, and dead-letter queues; Workflows (generally available) is durable execution for multi-step processes with retries, sleeps, and waitForApproval gates, the orchestration primitive under agents; Super Slurper migrates objects in bulk from S3, Google Cloud Storage, and any S3-compatible store into R2, and Sippy migrates on first read from S3, Google Cloud Storage, and Azure Blob, with zero egress on the Cloudflare side; Logpush streams logs to the enterprise's destinations. The data platform proper is arriving: Pipelines ingests from HTTP and Workers bindings, transforms with SQL, and lands Iceberg tables, Parquet, or JSON in R2 with exactly-once delivery; R2 SQL queries the catalog; Workers VPC Networks and Cloudflare Mesh reach private databases and APIs. All of those are beta, and none is scored. The buyer gets movement primitives they compose in code, and a lakehouse ingest path they can preview. Applying the general-versus-fixed-function test: what's generally available is general in kind (queues and durable workflows move anything) but carries no pipeline product: no ETL, no change data capture (CDC), no lineage, no cost-aware movement beyond zero egress, no KV-cache tiering. The migration tools are one-way into R2. Calibration: Snowflake, Databricks, and AWS read strong on managed pipeline portfolios; Elastic moderate on ingest fleets without CDC or lineage; MongoDB moderate on streams and CDC with fixed destinations. Cloudflare is below MongoDB (no CDC) and above gap (queues, workflows, and migration are shipped movement). Moderate.
Low, and split by component. Workflows executes the enterprise's step code and Queues delivers to the enterprise's consumers with no judgment of Cloudflare's own in the transformation, the override rule's third clause: code decides, visible, overridable, Retained, the Elastic and MongoDB 1C reading. Super Slurper's multipart choices and Logpush's fixed cadence are vendor-run mechanics inside those tools, named here and not the layer's dominant function. Every component is Cloudflare's to run, Ceded on portability.
Watch-list, notes only, and this is what moves the cell: Pipelines (open beta; SQL transformations, exactly-once to R2, Iceberg sinks), R2 SQL (open beta), R2 Data Catalog (open beta), Workers VPC Networks and Mesh (public beta since April 14, 2026), Dynamic Workflows (MIT library on Dynamic Workers, itself open beta). Settled: the judgment test (October 4, 2026) keeps code / Retained, because the scored engines run enterprise code and make no runtime choice of their own. Public evidence that moves the cell: GA badges on Pipelines and the catalog, or lineage.
GPU scheduling, quotas, RBAC, fair-share scheduling, utilization optimization
Generally available containers whose lifecycle is driven from a Durable Object in JavaScript, scaled manually today, with six instance sizes. Cloudflare's scheduler behind a JavaScript control surface: Ceded.
Generally available dispatch of tenant code into isolated namespaces, routed and rate-bounded by the enterprise's dispatch Worker. Cloudflare-only platform: Ceded.
Placement of Durable Objects by hint or jurisdiction (EU, FedRAMP, US). Configuration over Cloudflare's placement: Ceded.
The customer never schedules a GPU; Workers AI's fleet is scheduled by Cloudflare.
Orchestration on Cloudflare is the platform's, with a handful of levers the enterprise holds, and fewer than the marketing suggests. Workers scale to zero and to millions of isolates with no cluster to run; Durable Objects are placed near their first request, pinned by location hints, and confined by jurisdictions; Containers (generally available) are started, stopped, and addressed from a Durable Object in JavaScript, which is the whole orchestration API (the docs say it outright: instead of writing Kubernetes operators, you write JavaScript), but today they scale manually, by getting a container with a unique ID and starting it, and stateless routing is a fixed-count random choice that ignores location, with built-in autoscaling and routing on the roadmap; Workers for Platforms (generally available) dispatches tenant code into isolated namespaces, with the enterprise's own dispatch Worker choosing the target Worker and setting per-tenant CPU and subrequest limits in code on every request; Dynamic Workers (open beta) instantiate sandboxed isolates at runtime for agent-generated code; Smart Placement (beta) moves a Worker near its backends. The buyer gets a scheduler they never operate, can bound, and can't yet make elastic for containers. The architect's concern: none of this is a GPU plane, and the container plane isn't a scheduler yet. There are no accelerator quotas, no fair-share across a shared fleet, no capacity the enterprise reserves or observes for inference; Workers AI's scheduling is Cloudflare's alone. Placement across the network is Cloudflare's judgment with the enterprise's bounds on it. Calibration: Elastic reads moderate with authority Ceded on platform-scoped orchestrators; Snowflake moderate on managed compute with GA GPU pools; MongoDB moderate on cluster autoscaling and operators; AWS strong on EKS and capacity management; Nutanix moderate. Cloudflare is the platform-scoped case with an unusually broad isolate plane and a container plane still without autoscaling. Moderate, ruled October 5, 2026: containers and dispatch namespaces orchestrate the enterprise's own workloads under per-tenant quotas it sets, which meets the real-dependence guardrail on the Elastic side of the Kamiwaza line; manual scaling and no GPU plane hold it below strong.
Bounded, with enterprise code choosing what runs but not where. Jurisdictions, location hints, instance types, and namespace limits are configuration Cloudflare honors within its own placement and scaling judgment; the Workers for Platforms dispatch Worker is the enterprise's code choosing which tenant Worker runs and under what quotas on each request, which decides the workload, not its placement. Vendor decides placement and scaling, visible, not overridable, Ceded, the Elastic platform-scoped reading. The Container lifecycle code the enterprise writes is a control surface over Cloudflare's scheduler, not a scheduler of its own.
Ruled October 5, 2026: moderate holds. Containers and Workers for Platforms orchestrate the enterprise's own workloads under quotas it sets (the real-dependence guardrail, the Elastic and Kamiwaza line); manual container scaling is a maturity gate, not an absence of the function. Watch-list, notes only: Smart Placement (beta), Dynamic Workers (open beta for paid Workers accounts), built-in container autoscaling and routing (roadmap). Public evidence that moves the cell: container autoscaling reaching GA, or a GPU or shared-fleet scheduling surface the customer administers.
Model serving, agent execution, inference APIs, distributed inference
Serverless inference of open weights including Kimi K2.6, GLM-5.3, DeepSeek V4, Llama 4, gpt-oss, and Gemma 4 in 180+ cities, with LoRA adapters the enterprise trained elsewhere applied at runtime. Open models behind a standard-shaped interface the enterprise can serve elsewhere: Delegated.
Third-party and Cloudflare models reached through OpenAI- and Anthropic-compatible paths at one base URL. A broker the enterprise can replace with a base URL swap: Delegated, the managed-LLM precedent. Routing, guardrails, BYOK, logging, and unified billing are the gateway's control plane, scored at 2C.
MIT-licensed SDK whose agents are Durable Objects with SQLite state, hibernation, scheduling, long-running sessions, stateless remote MCP hosting with Access or OAuth Provider authorization, and documented approval gates. The code lifts, the stateful substrate exists only on Cloudflare: Ceded.
Containers driven from Durable Objects, the Sandbox SDK for agent code execution, and the Browser Run headless browser (Live View and Human in the Loop in beta). Cloudflare's substrates: Ceded.
The tool logic, handlers, and MCP servers the enterprise writes as standard JavaScript and TypeScript, runnable on the open-source workerd runtime outside Cloudflare (its README names self-hosting as a use). Retained on the customer-tools ruling where it uses web standards and workerd-supported bindings; dependencies on Cloudflare-only bindings are scored Ceded through those components.
Workers AI runs on Cloudflare-owned NVIDIA GPUs in 180+ cities; the Infire engine (Rust) serves trillion-parameter mixture-of-experts models such as Kimi K2.5 across eight H100s. No customer-side dependency; nothing the customer serves runs on their own GPUs.
Both halves of the layer are generally available and both live at the edge. Serving: Workers AI runs more than fifty open models on Cloudflare's GPUs, including frontier open weights (Kimi K2.6, a trillion-parameter mixture-of-experts model with 32 billion active parameters and a 262K context, added April 20, 2026; GLM-5.3; DeepSeek V4; Llama 4 Scout; gpt-oss; Gemma 4, the frontier tier behind a paid billing method) through the Workers AI binding and a REST API, with bring-your-own LoRA adapters for fine-tuned inference. AI Gateway (generally available on all plans) fronts Workers AI and more than seventy models across twelve-plus providers (OpenAI, Anthropic, Google, Groq, xAI, Bedrock, Azure OpenAI, Replicate, Alibaba, Bytedance, and more) through standard-shaped endpoints: an OpenAI-compatible chat-completions path for supported LLMs, an Anthropic-compatible messages path, an OpenAI Responses path, and Cloudflare's own run envelope for every modality, with one prepaid credit balance across Cloudflare's models and the third parties' since August 7, 2026. Agents: the Agents SDK (MIT) makes each agent a Durable Object with its own SQLite state, WebSocket sessions, scheduling, long-running sessions that survive hibernation (April 2026), an MCP client to any server, and remote MCP hosting through createMcpHandler for new stateless servers (the stateful McpAgent path is deprecated) with OAuth through Cloudflare Access or the Workers OAuth Provider library, plus two documented approval gates: needsApproval on a tool (a boolean or a predicate over the arguments) that parks the turn until a human answers, and Workflows' waitForApproval for gates that hold for days. Around it: Workflows (generally available), Containers and the Sandbox SDK, Browser Run, Dynamic Workers (open beta) for agent-written code, and Cloudflare OS (open-source, August 2026). The buyer gets inference and agents in the same 330-city network their traffic already crosses, with no cluster and no cold start worth naming. The architect's concern splits. The models are open and the interfaces are standard-shaped, so the model layer lifts; the agent layer doesn't. An agent written to the Agents SDK is a Durable Object, and Durable Objects, Workflows, and Vectorize exist only on Cloudflare; the code is MIT and the Workers runtime (workerd) is Apache 2.0 and self-hostable as an application server, but the stateful substrate the agents depend on isn't reproducible off the network. What the enterprise writes in plain Workers code (tools, handlers, MCP servers) is web-standard JavaScript that runs on workerd anywhere. Calibration: AWS, Google Cloud, and Azure read strong on serving plus agent runtimes; Mistral strong on serving plus a weights exit; Elastic moderate on brokered LLMs with no serving. Cloudflare has serving of open weights, a broker across twelve-plus providers (Azure's Foundry catalog and Google's Model Garden list more models; Cloudflare's breadth is providers behind one gateway), and a GA durable agent runtime with documented gates. Strong.
Low for the model, high for the harness. Open weights served through Workers AI read Delegated on the inference-interface ruling, and so does raw model access through AI Gateway's standard-shaped endpoints, a broker the enterprise can replace (the Elastic and ServiceNow managed-LLM precedent); the gateway's routing rules, guardrails, keys, and billing are its control plane, scored Ceded at 2C. The Agents SDK, Durable Objects, Workflows, Containers, and Browser Run are Cloudflare's runtime, Ceded, MIT license notwithstanding: the code lifts, the substrate doesn't. Customer-authored Workers code is web-standard JavaScript that runs on the Apache 2.0 workerd runtime outside Cloudflare, Retained on the customer-tools ruling where it runs on web standards and workerd-supported bindings; its dependencies on Cloudflare-only bindings (Vectorize, Workers AI, Queues) are scored Ceded through those components. The model decides which tool to call; needsApproval and waitForApproval are persisted gates before the effect, and AI Gateway guardrails block in line for non-streaming text-generation traffic (streaming responses on the REST path are evaluated and logged, not enforced): model decides, visible, overridable, Delegated.
Watch-list, notes only: Dynamic Workers (open beta), the next-edition Agents SDK preview (Agents Week, August 2026), bring-your-own-model on Workers AI (roadmap), Browser Run's Live View and Human in the Loop (beta), Cloudflare OS (open-source core, August 5, 2026), full Guardrails support for streaming (roadmap). Inference flagged: the fleet-wide GPU mix. Public evidence that moves the cell: nothing upward from strong.
Policy-driven placement and resource coordination — the Autonomy Layer
The generally available policy and observability layer over every model call, with routing flows the enterprise draws or writes as JSON, Cloudflare-held provider keys, and one credit balance. Cloudflare's control plane; the rules rebuild elsewhere: Ceded.
Generally available since March 11, 2026 as an Enterprise add-on: detection modules score incoming JSON prompts to labeled LLM endpoints and the enterprise's WAF rules block or challenge. Cloudflare's detections: Ceded.
Access issues and enforces the OAuth grants that gate remote MCP servers hosted on Workers and the portals in front of them; per-tool policy belongs to the beta portals. Cloudflare's identity plane: Ceded.
AI Gateway guardrails run Llama Guard 3 8B and Prompt Guard 2 86M on Workers AI; the firewall's detections run on Cloudflare's edge. No customer-side dependency.
Cloudflare's reasoning plane is a request-time gateway, which is the leg it was always going to ship first. AI Gateway (generally available) sits between every application and every model with rate limits, caching, logging of prompts and completions, cost tracking, bring-your-own keys in the Secret Store, one credit balance across providers, dynamic routing that segments users, enforces quotas, and picks models with fallbacks from rules the enterprise draws or writes as JSON, and guardrails that run Llama Guard 3 and Prompt Guard 2 over prompts and responses for supported non-streaming text-generation traffic (embeddings get prompt evaluation only, unknown model types skip response evaluation, and streaming responses on the REST path are logged rather than enforced); identity-aware analytics that attribute requests to users and flag rogue behavior are in open beta. AI Security for Apps (formerly Firewall for AI, generally available March 11, 2026, an Enterprise add-on) runs incoming JSON requests to endpoints labeled as LLM endpoints through detection modules for prompt injection, personally identifiable information, and unsafe or custom topics, and attaches scores the enterprise's Web Application Firewall (WAF) rules act on. Cloudflare Access is an OAuth provider for remote MCP servers and portals, so who may reach a server is a Zero Trust policy. What's coming is the rest of the plane: MCP Server Portals (open beta) put every MCP server behind one endpoint with Access policies, per-tool aliases and visibility, and per-request logging; Gateway now detects MCP traffic (the policy selector is beta) and an AI Security dashboard reports it; WriteGuard (private beta) governs write operations through MCP; Agent Traces (beta) trace agents; the Agent Access Model (a published architecture, not a product) proposes task-scoped agent identity. The buyer gets policy over model calls and LLM endpoints today, and policy over tool calls and agent identity on a visible roadmap. Applying the test: Intelligence-2C has a gateway leg (model calls, GA), an enforcement leg (LLM-endpoint firewall, GA), and an access leg for servers (Access as MCP OAuth, GA); no registry treating agents as governed assets, no agent principal (the Access Model is a proposal), no per-tool policy outside the beta portals, no cross-agent orchestration beyond Workflows inside one application, and agent observability in beta. Infrastructure-2C, placement across model, cost, and compliance tiers, shows up as dynamic routing: rules the enterprise writes, executed deterministically. Routing is not reasoning. Calibration: AWS reads moderate on Guardrails and AgentCore Policy; Azure strong on Entra Agent ID plus a gateway; Google Cloud strong on a complete plane; Nutanix moderate on gateway governance without placement; Databricks moderate on a gateway plus catalog governance; Elastic moderate on registry, orchestration, and observability legs. Cloudflare is Nutanix's shape with a real LLM firewall and the tool gateway in beta. Moderate.
Split between the enterprise's rules and Cloudflare's classifiers. Routing flows, rate limits, and Access policies are the enterprise's decisions executed deterministically; guardrails and the firewall are Cloudflare's models (Llama Guard 3, Prompt Guard 2, the PII and injection detectors) producing scores, with the enterprise's thresholds as configuration and its WAF rules as persisted gates before the effect. Vendor decides at the classifier, visible, overridable through the rules, Delegated, the Nutanix and Databricks gateway reading. On portability every component is Cloudflare's and Ceded: the rules are written in Cloudflare's dashboards and Terraform provider and rebuild elsewhere.
Watch-list, notes only, and these are the legs that move the cell: MCP Server Portals (open beta since August 2025; per-tool aliases and visibility live here), MCP traffic detection in Gateway (beta selector) and the AI Security dashboard (August 12, 2026), WriteGuard for MCP (private beta), identity-aware AI Gateway analytics (open beta), Agent Traces (beta), the Agent Access Model (proposal, August 5, 2026), full streaming enforcement for guardrails (roadmap). Public evidence that moves the cell: GA badges on the portals and an agent principal.
AI-powered business capabilities — business logic, workflow automation
Nothing at this layer exists to carry a dependency.
Cloudflare's own applications are about the agentic Internet rather than about a business process, and the one that's generally available is a policy console. AI Crawl Control (available on all plans since August 2025) gives every site owner visibility into AI crawlers and rules to allow or block them by bot and purpose, with the enterprise's WAF rules layered over it; charging for access through pay per crawl, where a crawler either presents payment intent or receives an HTTP 402 with a price, is in private beta and limited to Enterprise plans with Bot Management. The Agent Readiness diagnostics tell a site how agents read it; Answer Engine Optimization is early access; Radar Researcher (beta) answers questions about Internet traffic in plain language. The commerce surfaces are announced rather than shipped: the Monetization Gateway (waitlist since July 1, 2026) charges for any asset behind Cloudflare through x402, and Cloudflare Wallets and cloudflare.pay (announced August 4, 2026) give agents stablecoin wallets and identity handles, rolling out over the following months. Cloudflare OS (open-source, August 5, 2026) is a platform for building agents, apps, and work, used internally first. The buyer gets a control surface for the AI traffic hitting their properties, and a roadmap for getting paid by it. Applying the test: the layer asks for AI-powered business capabilities, and what's generally available is bot management for AI traffic, a console of the enterprise's own rules that runs no business process and carries no AI inside it. Everything that would be an application here is beta, waitlist, or announced. Calibration: Elastic and Qlik read strong on first-party security, observability, and analytics applications; AWS strong on the broadest ecosystem; CoreWeave moderate on Monolith's engineering-test modules, its Forge developer plane read at 2B; Nutanix partner, platform enablement earning no Layer 3 grade; NetApp gap as a foundation beneath others' apps; Cohere strong on a workspace. Cloudflare is the platform others build applications on. Gap, Absent, ruled October 5, 2026: AI Crawl Control is a rules console over AI traffic on Cloudflare's own edge, carrying no AI inside it, so it is neither an AI-powered business capability nor outside the exclusion of consoles, which earn no Layer 3 grade.
None to borrow at the layer's function: AI Crawl Control's rules are the enterprise's settings on a console, and the applications built on Workers are the enterprise's or an ISV's, scored on their rows. Absent: nothing offered at the layer's function, nothing inherited.
Ruled October 5, 2026: gap holds. AI Crawl Control is a rules console over AI traffic with no AI inside it, not an AI-powered business capability, and consoles over the vendor's own platform earn no Layer 3 grade. Watch-list, notes only: pay per crawl (private beta; Enterprise with Bot Management), Monetization Gateway (waitlist), Cloudflare Wallets and cloudflare.pay (rolling out), Radar Researcher (beta), Answer Engine Optimization (early access), Cloudflare OS (open-source core). Public evidence that moves the cell: a first-party application that runs a business process, or the commerce surfaces reaching GA.
Cloudflare developer documentation (Workers AI overview, models catalog, pricing, fine-tunes; AI Gateway overview, REST API, guardrails usage considerations and supported model types, custom providers; Agents SDK, human-in-the-loop, remote MCP server guide, MCP authorization; Workflows; Durable Objects SQLite storage and data location; Containers pricing and scaling and routing; Workers Placement; Workers for Platforms custom limits; Vectorize limits; AI Search limits and pricing; R2, R2 Data Catalog, R2 SQL, Pipelines, Super Slurper, Sippy; D1 import and export; Data Localization Suite; Queues; Workers VPC; AI Security for Apps; Cloudflare One AI controls and MCP server portals; AI Crawl Control and pay per crawl) and changelogs (Workers AI and AI Gateway unified billing, August 7, 2026; MCP detection and AI Security dashboard, August 12, 2026; Vectorize 20M vectors, August 4, 2026; VPC Networks and Mesh public beta, April 14, 2026; Durable Objects us jurisdiction, June 26, 2026; Kimi K2.6 on Workers AI, April 20, 2026); Cloudflare blog (Agents Week April 13 to 17 and August 3 to 7, 2026 posts; AI platform post, April 16, 2026; AI Security for Apps GA, March 11, 2026; MCP Server Portals; Infire and extra-large model serving; NVIDIA GPUs at the edge; Dynamic Workflows); the cloudflare/agents (MIT) and cloudflare/workerd (Apache 2.0) repositories; Q2 2026 results (August 6, 2026: revenue $696.1 million, 7.4 million Workers developers). Peer-reviewed cell by cell through the labs claims ledger (cloudflare-<layer>-chatgpt, ChatGPT gpt-5.5) and as a whole row by Antigravity (cloudflare-row-agy); totals and escalated items in labs/reviews/cloudflare-judgment.md. /reconcile (October 5, 2026): Layer 3 calibration citations updated for the Layer 3 re-reads (Nutanix, VAST, VMware to partner; CoreWeave, NVIDIA, AMD to gap) and the MongoDB BI ruling; no grade or authority change on this row. /reconcile (October 5, 2026): settled escalations cleared from the published text and ruling attributions neutralized; open escalations stay named as pending a ruling. No grade, component, or authority change. /reconcile (October 5, 2026): Layer 0 escalation ruled: moderate holds on reading Layer 0 by the vendor's shape (September 15, 2026), self-service CPU compute and connectivity sold beside the service, the SAP precedent. No grade, component, or authority change. /reconcile (October 5, 2026): 2A escalation ruled: moderate holds on the real-dependence guardrail (containers and dispatch orchestrate the enterprise's own workloads under per-tenant quotas, the Elastic side of the Kamiwaza line); manual scaling and no GPU plane hold it below strong. No grade, component, or authority change. /reconcile (October 5, 2026): Layer 3 escalation ruled: gap holds. AI Crawl Control is a rules console over AI traffic with no AI inside it, and consoles over the vendor's own platform earn no Layer 3 grade. No grade, component, or authority change. /reconcile (October 5, 2026): the 1C authority question settled by the judgment test (October 4, 2026); reading unchanged. v1.8 (Layer 0 sub-layers, October 16, 2026): Layer 0 split into 0A Compute, 0B Network Fabric and 0C Storage Substrate by runtime decision (Keith, October 16, 2026); storage left 1A for 0C, and 1A, now Data Foundation & Governance, is graded on the catalog that classifies the data. 0A moderate, 0B moderate, 0C moderate; summary edits (summary worksheet, Keith, October 16, 2026). v1.9 (October 19, 2026, /reconcile): plain-language pass: methodology rule numbers in the prose and audit notes replaced with the reasoning they stood for; no grade, chip or authority reading changed.