Intel / blog

How Cloudflare enforces engineering standards using AI

Source: blog.cloudflare.com
Author: Timo Reimann
Date: Published Aug 4, 2026

Context

Cloudflare makes its engineering rules usable by AI reviewers by separating advice from enforceable requirements. Domain owners approve standards, which agents retrieve as compact statements with stable identifiers. A newly approved rule can produce recommendations; blocking begins only after the standard enters enforcement and a mandatory requirement is unmet. This gives teams time to adopt a rule before it can stop their work. The company’s account reports roughly 230,000 flagged deviations, with almost 16,000 findings causing approval to be withheld. Those counts measure standards enforcement, rather than confirmed software defects or production incidents prevented.

Key takeaways · AI-distilled

In four months Cloudflare's AI code reviewer flagged ~250K standards violations and blocked 16,000 merges, and a spec reviewer evaluated ~600 designs pre-implementation — all driven by one governed standards corpus (the Codex).
Standards are RFCs using RFC-2119 SHOULD/MUST keywords with domain owners and a proposal/review workflow; enforcement is a separate lifecycle promotion after approval, giving teams time to absorb new requirements.
Feeding 60+ full RFCs to an degrades results — a purpose-built compacts the SHOULD/MUST statements into JSON enriched for lazy discovery and progressive disclosure, loading full RFC bodies only when needed.
Every statement gets a stable slug that survives RFC updates, so the same requirement can be tracked across systems over time — the backbone for monitoring, analysis, and exception handling.
SHOULD vs MUST plus RFC status determines behavior: approved RFCs yield non-blocking recommendations; once enforced, an unsatisfied MUST blocks the merge.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.

Key quotes

“Over the past four months, our AI code reviewer has flagged nearly a quarter of a million deviations from Cloudflare engineering standards (what we’ll call “violations” in this post) and blocked 16,000 merges.”

“Engineers often spent too much time searching for guidance instead of working on the problem they were trying to solve.”

“The longer-term goal is for agents to identify issues as well as propose fixes with increasing autonomy, while engineers remain responsible for reviewing and approving those changes.”

“We have found AI most useful when it brings the right guidance to engineers at the point of work, and plan to keep extending the approach across Cloudflare.”

Read the source blog.cloudflare.com