Agents Week 2026 · noble demos

Last year, we put guardrails around how people use AI.
This year, the AI is the user — so the guardrails go around the agent itself.

Last year

Wayve showed the old boundary.

Last year the story was Wayve. They paid for ChatGPT Enterprise and still couldn't stop people pasting company code into their personal accounts. The licence was never the problem. The boundary was. So we moved it: one sanctioned front door, tenant control with Zero Trust, and the data stopped walking out.

Employeehuman userPersonalChatGPTSanctionedfront doorZero Trust tenant control moves the boundary.

This year

The caller is no longer a person.

Agents clone repos, run code, and call APIs. Their hands reach files, hosts, and commands.

Prompting is not a boundary. Guardrails are.

OrchestratorWorker Aallowed pathWorker Bproof path

@cloudflare/computer

Give every Worker agent a Workspace.

A Workspace is the agent's computer: durable filesystem, command execution, and observable operations.

Two Worker agents means two separate computers by construction.

Workspace Aclone repo
read README
grep TODO
Workspace Bseparate files
same task
different Guardrails
Read-only mountpolicy data can be read, not changed
Audit trailevery operation becomes ALLOW or DENIED

@cloudflare/computer — under the hood

Where the package is doing the work.

getWorkspace() attaches a Worker agent to its own durable Workspace, backed by WorkerShellBackend running inside a Cloudflare Worker.

The read-only R2 mount and the observer are wired at startup — Guardrails in place before the first line of task code runs.

getWorkspace()attaches the agent to its own private Workspace
ws.fsdurable filesystem: readFile, writeFile, grep
ws.runtimecommand execution: git clone, shell commands
WorkerShellBackendthe execution engine — no external machines
/workspace/r2read-only R2 mount — policy data, not writable
makeObserverevery op → Audit trail ALLOW or DENIED

Guardrails

Control the boundary, not the next token.

Filesystem isolation. Egress allowlist. Read-only mounts. Observable Audit trail.

Zero Trust is the lineage of the egress allowlist — the live control in this demo is the Worker agent's fetchTools.allowlist. AI Gateway is the model-call control point; a log ID in the Audit trail confirms a live routed call.

Worker agentWorkspaceDENIED

Live proof

Watch a Worker agent get told “no”.

Worker A stays green. Worker B hits the wall. The red row is the demo.

ALLOW→DENIED

Open the live Audit trail

Worker Aclone/read/grepWorker Boff-allowlist fetchBLOCKED

Why it lands

Same move. New subject.

Last year: untrusted human intent. This year: untrusted agent action.

The boundary moves from the person using AI to the AI acting as the user.

Reference point: last year's deck, “Create and secure an AI agent wrapper using AI Gateway and Zero Trust.”

Tutorial: developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/