Cloudflare's Chief Information Officer has published an account of how the company built an internal platform, called Cloudflare OS, after staff across the business (including non-engineers) started using AI tools to build their own apps. The trigger was a salesperson asking for production access to about a dozen internal systems plus admin rights to a deployment pipeline, in order to run something they had built themselves.
Cloudflare OS itself is not aimed at a five-person business in Cave Creek. It is an enterprise platform built to solve an enterprise-sized problem. You do not need it, and nothing about your website changes today.
The reason this story is worth two minutes of your time is the situation that caused it. Someone in a non-technical role built something useful, and then asked for the keys to live systems to make it work. That request is now completely normal, and it is going to land on your desk eventually, if it has not already. Someone in your office will build a quoting tool, a customer follow-up script or a reporting dashboard with an AI assistant, and they will need it connected to your booking system, your CRM (the database of your customers and leads) or your website's back end.
The practical risk is not that the tool is bad. It is that granting broad access is easy and quietly permanent. "Production access" means the live system with your real customer records in it, not a copy. Admin permissions mean the person can change or delete things, not just read them. Once handed out, those permissions tend to sit there for years, attached to an account nobody reviews, sometimes belonging to someone who has left.
What to do:
- Know who currently holds admin access to your website, your email platform and any customer database. If the answer takes you more than a minute, that is the finding.
- Decide now that connecting anything new to live customer data is a conversation, not a favour.
- Ask your developer to set up read-only access or a test copy for staff experiments. It is usually a small job.
Encourage the tinkering. Just keep it away from the real data until someone has looked at it.
Reported by:
