See my next tweet in the chain:

https://x.com/KentonVarda/status/2084990302784307363

-------------

Of course, personal apps are more useful if they can connect to external services. Cloudflare OS introduces a "connector" system we call Gatekeepers. This is sort of like MCP (and MCP is supported as a kind of Gatekeeper), but with a lot more:

* Instead of exposing tools, a Gatekeeper exposes a Cap'n Web RPC API. That makes it appropriate for use by both agents (via code mode) and Gadgets.

* Gatekeepers integrate with the Cloudflare OS UI to provide inline audit logging and human-in-the-loop approvals for all side-effecting actions.

* When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)

We have already built Gatekeepers for a huge number of services, from GitHub to Home Assistant. We've found, with the right skills, AI can basically crank these things out for any given API, solving the chicken-and-egg ecosystem problem. We are working on a "software factory" of sorts where you can input the API docs for your favorite service and get a well-written Gatekeeper. That's not quite ready yet -- so for now use the ones we provide or use the write-gatekeeper skill to write your own. You can add your own Gatekeepers to your personal deployment.

▲

kentonv 6 hours ago | parent | next [-]

Or more directly:

When you share a Gadget, we verify that anyone you share with also has direct permission to access each of the resources it is connected to (via the Gatekeeper system). Hence, no security bug in the Gadget itself could accidentally grant people access to things they don't already have.

▲

techpression 3 hours ago | parent [-]

But that is a problem. I have access to something deeply secret, I run a gadget, it reads that and sends it to whoever made it

▲

kentonv 3 hours ago | parent [-]

No, a Gadget does not just get automatic access to your data. It only gets access to the things you grant it explicitly.

	▲	techpression 3 hours ago \| parent [-]
		Just like phishing websites, which are still a problem. I’m sure I’m being overly cautious, but this sounds like a recipe for data leaks with the low barrier to entry. And if you want real life examples, every single LLM provider has gotten insane amounts of data shared to them, even if you have to approve.

▲

shostack 6 hours ago | parent | prev | next [-]

> * When an action requires approval, the agent does not need to stop and wait for it. A Gatekeeper will simulate the outcome, allowing the agent to keep running and queue up more work. You can then approve everything in a batch at the end. Hopefully, this means you no longer feel the need to turn on auto-approve! (But you still can if you want.)

Can you say more about how you simulate outcomes of approvals? For example, if I need an approval to be granted permission to read a document, how could it simulate the document contents?

	▲	kentonv 6 hours ago \| parent \| next [-]
		Reads do not require approval. Only writes do. Reads are, however, limited to only the resources you have explicitly attached. Moreover, since agents and gadgets run in a sandbox with essentially no access to the outside world except via approved channels (Gatekeepers), it's essentially not possible for the agent to leak secrets it has seen unless you approve a later write. In fact, the system actually keeps track of everything the agent / gadget has observed to know if it is "tained", and can use that to flag later actions as dangerous, e.g. due to prompt injection or possible leaking of secrets. (This is still evolving, but all the groundwork is there.) (Of course, this assumes you trust the LLM provider itself not to steal secrets from your prompts. Most LLM providers offer zero-data-retention options, but if you don't trust them you can also use a local LLM. We support ollama and will support others in time.)
	▲	ocdtrekkie 6 hours ago \| parent \| prev [-]
		The key aspect here is "when an action requires approval". i.e. an action which writes. Presumably you are granting the read access when firing this process off in the first place.

▲

edaemon 5 hours ago | parent | prev [-]

Interesting, so how does this work with regards to purposeful but naive changes? If, for example, we have a Notion integration, and a non-technical user can add a feature to it via prompt, would it be possible for them to accidentally add something that sends a bunch of internal-only proprietary data to Notion? Would this system prevent or flag that in some way?

	▲	kentonv 5 hours ago \| parent [-]
		Gatekeepers can specify the sensitivity of their data. A Gatekeeper can actually flag an observation (a read operation) as being so sensitive that the agent should be prohibited from writing anywhere else after having seen that. This is what allowed us to connect Cloudflare OS to our own sensitive internal data sources, containing things like customer data, revenue info, etc. Once you connect to one of those, the system enforces no data can be shared out of it. That said, the policies are a bit blunt right now, maybe overly restrictive. We're going to be evolving it further.