Cloudflare separates security evidence collection from agent judgment

Cloudflare describes rebuilding a security-analysis workflow after a single agent confused hypotheses with evidence and mishandled lookups. Deterministic code now collects versioned evidence before specialist agents analyze traffic, customer history and threat intelligence. A final synthesis step works only from admitted evidence, while missing checks remain explicitly different from checks that found nothing.

Cloudflare · Oct 7, 2026

Why it matters

This is a concrete pattern for making operational agents explain their conclusions and abstain when evidence is incomplete.

More context

Read it as a managed-service architecture case study. Checkpoints preserve validated stages, and human analysts retain mitigation decisions. Try separating collection, interpretation and approval in your own workflow; record source versions and timestamps alongside each finding.

Keep in mind

The article describes Cloudflare’s implementation rather than a downloadable general-purpose agent. Its reliability account is vendor evidence, and this edition did not reproduce the results. The architecture extends the previously covered Clef model story.

Original read