How Cloudflare enforces engineering standards using AI
Source
Timo Reimann
Author
Timo Reimann
Date
Key takeaways · AI-distilled
In four months Cloudflare's AI code reviewer flagged ~250K standards violations and blocked 16,000 merges, and a spec reviewer evaluated ~600 designs pre-implementation — all driven by one governed standards corpus (the Codex).
Standards are RFCs using RFC-2119 SHOULD/MUST keywords with domain owners and a proposal/review workflow; enforcement is a separate lifecycle promotion after approval, giving teams time to absorb new requirements.
Feeding 60+ full RFCs to an LLMA large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.Full definition → degrades results — a purpose-built AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → compacts the SHOULD/MUST statements into JSON enriched for lazy discovery and progressive disclosure, loading full RFC bodies only when needed.
Every statement gets a stable slug that survives RFC updates, so the same requirement can be tracked across systems over time — the backbone for monitoring, analysis, and exception handling.
SHOULD vs MUST plus RFC status determines behavior: approved RFCs yield non-blocking recommendations; once enforced, an unsatisfied MUST blocks the merge.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.
Why it matters
A concrete, measured blueprint for making engineering standards machine-enforceable so AI reviewers apply them consistently at scale.
Key quotes
“Over the past four months, our AI code reviewer has flagged nearly a quarter of a million deviations from Cloudflare engineering standards (what we’ll call “violations” in this post) and blocked 16,000 merges.”
“Engineers often spent too much time searching for guidance instead of working on the problem they were trying to solve.”
“The longer-term goal is for agents to identify issues as well as propose fixes with increasing autonomy, while engineers remain responsible for reviewing and approving those changes.”
“We have found AI most useful when it brings the right guidance to engineers at the point of work, and plan to keep extending the approach across Cloudflare.”
