How Cloudflare enforces engineering standards using AI
The Cloudflare Blog
Cloudflare built an AI system called the Codex that checks code, design docs, and incident reports against internal engineering standards. It's already flagged 230,000 violations and blocked 16,000 merges, showing how far AI code review has come.
Cloudflare just published a look under the hood at how it keeps thousands of engineers rowing in the same direction, and the answer is a mix of old-school governance and new AI muscle. The company built something called the Cloudflare Codex, essentially a single, structured rulebook for engineering standards that both humans and AI agents can query. Before it existed, guidance was scattered across wikis, Slack threads, and the heads of senior engineers who happened to remember why a decision was made three years ago. That's a familiar problem at any company past a certain size, but Cloudflare decided to solve it by making the rulebook machine-readable from day one.
The numbers are the interesting part. Since the Codex launched earlier this year, an AI code reviewer has flagged nearly 230,000 violations of engineering standards and blocked about 16,000 merge requests outright. A separate spec-reviewer agent has combed through almost 600 technical design documents before a single line of code got written, racking up more than 3,200 review runs since May. A third agent reviews incident postmortems, checking whether teams actually documented what broke and what they're doing about it. All three pull from the same underlying source of truth rather than each having its own baked-in notion of best practices.
What makes this more than a glorified linter is the RFC-style workflow behind it. Standards get written up using the classic SHOULD and MUST language from RFC 2119, reviewed by domain owners, and only start blocking merges after they graduate from
My take
The real story here isn't the AI, it's the discipline of writing rules down in a format a machine can actually parse, something most companies never bother to do until they're forced to. Everyone wants an AI agent to enforce standards, but almost nobody wants to do the boring governance work first, and Cloudflare's approach is basically the unsexy engineering hygiene that made the flashy automation possible. If this trend catches on, the winners won't be the ones with the smartest models, they'll be the ones with the cleanest internal documentation.
Read more about this at: The Cloudflare Blog
