How Cloudflare Enforces Engineering Standards with AI

Cloudflare's AI code reviewer identified nearly 250,000 engineering standards violations and blocked 16,000 merges over the past four months. A technical design review agent also applied the same standards to evaluate approximately 600 designs before implementation.

The foundation of this system is Cloudflare Codex, an engineering knowledge repository used by both humans and AI agents. Previously, guidelines were scattered across official documentation, repository files, chat logs, and individual engineers' experiences, making it difficult to determine their currency, authority, and applicability.

Codex manages engineering standards by domain.

• Architectural domains such as frontend and control plane
• Cross-cutting concerns like security and reliability
• Standards for programming languages such as TypeScript and Rust

Owners of each domain manage the content, consistency, and quality of the documentation. Standards are written in RFC format using the SHOULD and MUST keywords defined in RFC 2119, and metadata such as domain and RFC status is also managed.

Employees can propose RFCs via merge requests with a defined structure. Proposals undergo a review process that gradually expands in scope, and once approved by the domain owner, they are incorporated into Codex and published on an internal Astro-based site.

Approved RFCs can be used by Codex clients and agents to immediately detect violations in code, configuration, and documentation. However, actual merge blocking only occurs after an RFC is promoted from approved to enforced status. This separate step provides teams time to accept new requirements and allows for response if additional automated enforcement work is needed.