Cloudflare uses AI to police code

Cloudflare is deploying artificial intelligence to enforce its engineering standards, a move that has already flagged hundreds of thousands of code deviations and blocked thousands of merges. Over the past four months, the company's AI code reviewer identified nearly 250,000 violations of its engineering best practices. Its companion, a spec reviewer agent, has evaluated about 600 technical designs prior to implementation. This initiative draws from the Cloudflare Codex, a unified repository of engineering guidance designed for both human and automated consumption.

The need for such a system became apparent as Cloudflare grew. Previously, engineering guidance was scattered across documentation, code repositories, chat logs, and individual engineers' knowledge. This fragmentation made it difficult for developers to find current and authoritative information, leading to wasted time and inconsistent application of standards. Relying solely on human reviewers also became unsustainable; no single engineer could possibly read and verify every standard across all projects.

Building the Codex

To address this, Cloudflare constructed the Codex, a structured collection of engineering standards. This centralized knowledge base allows AI agents to access and apply guidance directly at the point of work, whether it's code review, technical design evaluation, or incident report analysis. The Codex is organized into distinct domains, such as architectural patterns, security, reliability, and specific programming languages. Each domain is managed by an owner responsible for its content quality and consistency.

Standards within the Codex follow an RFC (Request for Comments) format, using keywords like MUST and SHOULD as defined by RFC 2119. Any employee can propose a new standard via a merge request. These proposals undergo multiple rounds of feedback before an owner grants final approval, at which point the RFC becomes part of the Codex and is published internally. Initially, approved RFCs generate non-blocking findings. However, after an explicit promotion step, enforced RFCs can block merges that violate MUST requirements, providing a crucial buffer for teams to adapt to new standards.

AI's Role in Enforcement

Feeding the entire Codex corpus directly to a large language model would strain context windows and degrade performance, especially as the number of RFCs grows. Cloudflare employs a purpose-built agent to extract and condense MUST and SHOULD statements into a structured JSON format. This process enriches the data with metadata, enabling efficient retrieval and progressive disclosure of relevant standards. Each extracted statement receives a stable slug identifier, crucial for tracking across different systems over time for monitoring and exception handling.

The JSON output, an example of which details control plane service requirements, includes fields like `rfc`, `title`, `status`, `domain`, and `statements`. Each statement contains its own `slug`, `section`, `level` (MUST or SHOULD), `text`, and `href` for easy reference. This structured approach allows AI agents to precisely identify and flag deviations, freeing up engineers to focus on higher-level problem-solving and strategic development rather than manual compliance checks.

Why This Matters

Cloudflare's approach highlights a significant trend: the increasing reliance on AI not just for creating software, but for ensuring its quality and adherence to organizational policies. As software complexity and development velocity accelerate, traditional methods of code review and standard enforcement struggle to keep pace. By automating much of this process, Cloudflare aims to maintain engineering rigor at scale, prevent knowledge silos, and reduce the costly errors that can arise from inconsistent practices. This could set a precedent for other large tech organizations grappling with similar scaling challenges. For startups, the underlying principle of codifying and automating best practices, even without massive AI teams, offers a valuable lesson in building scalable, high-quality products from the ground up.