Cloudflare runs a Managed Defense service that triages thousands of security alerts daily. Instead of building a single monolithic AI analyst, they built a team of specialized agents on Cloudflare Workers that separate deterministic evidence collection from LLM inference. The architecture prevents hallucination by forcing every recommendation to cite raw telemetry before any model touches it.
This is production agentic infrastructure for high-stakes security operations. The design choices matter because a wrong recommendation can trigger incident response theater or miss a real breach.
Why Evidence-First Architecture
Security operations agents fail when they confabulate attack patterns or recommend actions based on plausible-sounding but fictional evidence. Cloudflare’s approach treats the LLM as a reasoning layer that operates only on pre-validated facts.
The pipeline works in three stages:
- Evidence collection: Deterministic queries against Cloudflare’s global network telemetry, DNS logs, HTTP traffic patterns, and threat intelligence feeds. No model involvement.
- Context assembly: Structured data objects that represent alert metadata, related events, historical patterns, and known attack signatures. Still deterministic.
- Inference layer: LLM agents receive evidence bundles and generate recommendations, but every claim must reference a specific evidence artifact.
This separation means you can audit the reasoning chain. If an agent recommends blocking a subnet, the recommendation includes pointers to the exact log entries, traffic spikes, or threat intel matches that support it.
Agent Team Structure
Cloudflare runs multiple specialized agents instead of one general-purpose security analyst. Each agent owns a narrow domain:
- Triage Agent: Classifies alert severity and routes to appropriate investigation workflows
- Investigation Agent: Queries telemetry sources and assembles evidence bundles
- Recommendation Agent: Generates response actions grounded in collected evidence
- Validation Agent: Cross-checks recommendations against historical false positive patterns
Agents coordinate through a shared context object that accumulates evidence and reasoning steps. Each agent appends its findings and passes the enriched context to the next stage.
The orchestration layer runs on Cloudflare Workers, which gives agents low-latency access to the same global network data that powers Cloudflare’s edge services. An agent investigating a DDoS alert can query traffic patterns across 300+ data centers without leaving the Workers runtime.
Orchestration Flow
Here’s how the system handles an inbound security alert:
interface AlertContext {
alert_id: string;
raw_event: SecurityEvent;
evidence: EvidenceBundle[];
agent_history: AgentStep[];
recommendation: Recommendation | null;
}
async function processAlert(alert: SecurityEvent): Promise<AlertContext> {
let ctx: AlertContext = {
alert_id: generateId(),
raw_event: alert,
evidence: [],
agent_history: [],
recommendation: null
};
// Stage 1: Triage (deterministic classification)
ctx = await triageAgent.classify(ctx);
// Stage 2: Evidence collection (no LLM)
ctx = await investigationAgent.gatherEvidence(ctx);
// Stage 3: LLM inference (grounded in evidence)
ctx = await recommendationAgent.analyze(ctx);
// Stage 4: Validation (check against known FP patterns)
ctx = await validationAgent.verify(ctx);
return ctx;
}The EvidenceBundle type enforces structure. Each piece of evidence includes a source identifier, timestamp, query parameters, and raw result set. The recommendation agent cannot invent evidence; it can only reference items already in the bundle.
State Management and Handoffs
Agent handoffs happen through context mutation. Each agent reads the current context, performs its specialized task, appends results, and returns the updated context. The orchestrator decides whether to route to another agent or surface the recommendation to a human analyst.
State persistence uses Cloudflare Durable Objects for long-running investigations. If an alert requires multi-hour analysis (waiting for additional telemetry, correlating with external threat feeds), the Durable Object maintains context across multiple agent invocations.
Handoff logic includes retry policies and fallback paths. If the recommendation agent times out or returns an unparseable response, the orchestrator can route to a simpler rule-based fallback or escalate directly to a human.
Observability and Audit Trail
Every agent step writes structured logs to Cloudflare’s analytics pipeline. Logs include:
- Agent type and version
- Input context snapshot
- Evidence artifacts accessed
- LLM prompt and response (if applicable)
- Output context diff
- Execution time and token usage
Managed Defense analysts see a timeline view of agent reasoning. They can click any recommendation and drill into the evidence bundle, view the exact LLM prompt, and see which telemetry queries returned which results.
This audit trail is critical for tuning. When an agent produces a false positive, engineers can replay the context through updated agent versions and compare outputs. When an agent misses a real threat, they can inspect which evidence was missing and add new telemetry sources.
Security Boundaries
Agents run in isolated Workers with restricted permissions. The investigation agent can query telemetry but cannot execute response actions. The recommendation agent can generate block lists but cannot apply them. Only the validation agent can promote a recommendation to executable status, and even then a human analyst must approve high-impact actions.
LLM API calls route through a dedicated gateway that enforces rate limits, logs all prompts and completions, and strips sensitive data before sending to external model providers. Cloudflare uses this gateway to experiment with different models (GPT-4, Claude, internal fine-tunes) without changing agent code.
Deployment Shape
The entire system runs on Cloudflare’s edge:
- Workers: Agent execution runtime
- Durable Objects: Stateful investigation context
- KV: Threat intelligence cache and historical false positive patterns
- R2: Long-term storage for evidence bundles and audit logs
- Analytics Engine: Real-time metrics and log aggregation
This deployment shape means agents execute close to the telemetry sources. An investigation agent querying DNS logs in Singapore runs in a Singapore data center with local access to that region’s DNS resolver logs.
Global telemetry access is the key architectural advantage. Traditional security operations tools aggregate logs into a central SIEM and run analysis there. Cloudflare’s agents query distributed data sources directly, which reduces latency and eliminates the data movement bottleneck.
Failure Modes
The system degrades gracefully when components fail:
| Failure | Impact | Mitigation |
|---|---|---|
| LLM API timeout | Recommendation agent stalls | Fallback to rule-based heuristics after 10s |
| Evidence query timeout | Incomplete context | Partial analysis with confidence score penalty |
| Durable Object unavailable | Lost investigation state | Retry with exponential backoff, escalate to human after 3 attempts |
| Agent produces unparseable output | Orchestrator cannot route | Log error, skip to next stage, flag for manual review |
| Validation agent rejects recommendation | No action taken | Surface to analyst with rejection reason and evidence bundle |
The evidence-first architecture limits blast radius. If the recommendation agent hallucinates, the validation agent catches it because the recommendation cannot cite supporting evidence. If the validation agent fails, the system defaults to human review rather than auto-executing a questionable action.
Trade-offs
Evidence separation adds latency. Collecting telemetry before invoking the LLM means each alert takes longer to process. Cloudflare accepts this trade-off because accuracy matters more than speed in security operations.
Specialized agents increase complexity. A single general-purpose agent would be simpler to build and maintain. But specialization improves accuracy and makes it easier to tune individual components. When the triage agent misclassifies alerts, you can retrain just that agent without touching investigation or recommendation logic.
Workers deployment limits model choice. Running agents on the edge means you cannot use large on-premise models that require GPU clusters. Cloudflare routes LLM calls to external APIs, which introduces dependency on third-party uptime and rate limits.
Technical Verdict
Use this pattern when you need LLM-powered analysis in domains where hallucination is unacceptable. The evidence-first architecture works for security operations, financial fraud detection, medical diagnosis support, or any workflow where recommendations must be auditable and grounded in verifiable facts.
Avoid it if you need real-time response (sub-second latency) or if your evidence sources are slow to query. The multi-stage pipeline adds overhead that may not fit latency-sensitive use cases.
The Cloudflare Workers deployment shape makes sense if you already run on Cloudflare’s platform or if your telemetry sources are globally distributed. If your data lives in a single data center, the edge execution advantage disappears.
This architecture shines when you have high-quality structured telemetry and need to combine it with LLM reasoning while maintaining full auditability. It is overkill for low-stakes automation where occasional errors are acceptable.