Cloudflare enforces engineering standards using AI

Who Should Read

Platform or backend developers whose written coding and design standards aren't consistently enforced in code review.

Core Mechanics

• Standards were consolidated into one Codex
  • Guidance scattered across docs, repo files, chat, and people's heads was rebuilt into one set for humans and agents.
  • Domain owners are responsible for content and quality.
• Standards are RFCs with MUST/SHOULD
  • Requirements use the RFC 2119 keywords, with front matter for domain and RFC status.
  • Anyone can propose via merge request, and the domain owner gives final approval.
• Approved and enforced are separate states
  • Approved RFCs only produce non-blocking findings.
  • Only MUST violations of enforced RFCs block merges.
  • The gap gives teams time to absorb new requirements.
• Statements are compacted into JSON, not fed whole
  • With 60+ RFCs, the full corpus would strain the context window and hurt results.
  • A dedicated agent extracts SHOULD/MUST statements into JSON with slug, level, section, and link.
  • It started as Markdown and moved to JSON for more accurate filtering.

Community Reactions

• Opinion that the post is unremarkable
  • One commenter said that defining review rules like linter rules for an AI agent needs no nine-minute read.
• Opinion that the reviewer itself isn't improved
  • A commenter who built a similar system said Cloudflare improves the Codex but not the reviewer model.
  • They argued that loop needs closing.
• Experience that companies build their own AI review
  • A W24 founder said they pivoted away from AI code review for this reason.
  • They called the direction right.
• Concern about writing every standard as an RFC
  • Some found that burdensome, while another commenter said it's a good thing from an SRE perspective.

How to Apply

• Turn 5 team rules into MUST/SHOULD JSON
  • Pick the 5 rules most often raised in your code review comments.
  • Write them as JSON with slug, level, and text.
  • Paste them into the prompt below with a PR diff.
• Add approved and enforced stages to your standards
  • Start new rules as advisory comments only.
  • Promote them so only MUST violations block merges once the team has adapted.
• Move mechanical rules into a linter
  • Pick rules the AI reviewer flags repeatedly that static analysis can catch.
  • Move them into linter config for millisecond feedback.
• Apply the same rules to design docs
  • Evaluate specs against the same JSON rules before implementation.
  • Map MUST/SHOULD to critical/major/minor severity.

Try It

# Paste into Claude or ChatGPT (simplified version of Cloudflare's Codex approach)

You are a code reviewer. Compare the standards JSON below with the diff and report only violations.

[Standards]
{"statements":[
{"slug":"api-schemas-must-be-documented-in-openapi-spec","level":"MUST","text":"API request and response schemas MUST be documented using an OpenAPI spec"},
{"slug":"{{rule slug}}","level":"SHOULD","text":"{{your team rule}}"}
]}

[diff]
{{PR diff}}

Rules:
- For each violation, give slug, level, code location, and a fix.
- Mark SHOULD violations as non-blocking and MUST violations as blocking.
- If there are none, answer only "No violations".

Next: grow to 20 rules and count which ones trigger most often.

Terminology

Related Papers

• Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy

  Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.

• Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

  Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.

• Harness Engineering 101: The LLM is the brain, the harness is the body

  An agent is a loop managing a JSON array; 16 chapters build one from scratch

• Harness2 by Google Research – Recursive Agent Harnessing

  Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.

• Ousted Savannah police officer gave ICE agent husband access to Flock system

  A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired

• Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling

  Running Claude Code agents in tmux works well, but limits appear around four agents.

Related Resources

• https://blog.cloudflare.com/engineering-standards-enforcement/
• https://textslashplain.com/2026/08/04/security-is-hard-yall/
• https://arxiv.org/pdf/2607.17044