Cloudflare Agentic Security Operations: An Architecture Separating Evidence from Reasoning

When large language models are introduced into security operations, the most fatal failure mode isn't that the model isn't smart enough—it's that it fabricates an attack chain that sounds completely plausible but has no factual basis whatsoever. Cloudflare triages thousands of security alerts every day in its managed defense service, and it chose a path fundamentally different from the mainstream "monolithic AI analyst": completely separating deterministic evidence collection from LLM reasoning, and building a team of specialized agents running on Cloudflare Workers.

Why Evidence-First Is the Architectural Cornerstone

The core risk of security operations agents lies in "fabricated evidence"—the model may offer response recommendations based on attack characteristics that seem plausible but are actually fictitious. In a real environment, bad recommendations can trigger unnecessary incident response procedures, or allow a genuine intrusion to be overlooked.

Cloudflare's approach strictly limits the LLM to the reasoning layer, acting only on pre-validated facts. The entire pipeline is divided into three stages: the evidence collection stage runs deterministic queries against global network telemetry, DNS logs, HTTP traffic patterns, and threat intelligence feeds, with no model involved at all; the context assembly stage builds alert metadata, correlated events, historical patterns, and known attack signatures into structured data objects, still remaining deterministic; the reasoning layer stage hands the evidence bundle to LLM agents to generate recommendations, but every assertion must cite a specific evidence artifact.

The direct benefit of this separation is auditability. When an agent recommends blocking a subnet, the recommendation comes with pointers to specific log entries, traffic spikes, or threat intelligence match records, and analysts can trace the reasoning chain layer by layer.

LLM hallucination refers to a large language model generating content that is grammatically fluent and logically coherent but inconsistent with reality, even in the absence of factual basis. In security operations scenarios, this kind of hallucination is especially dangerous: the model may fabricate a non-existent CVE number, invent a lateral movement path that never happened, or misattribute an IP address as a known malicious source. Because the daily work of security analysts is itself about distinguishing signal from massive noise, a seemingly professional fabricated attack chain is extremely easy to trust, triggering incorrect blocking, isolation, or escalation actions. Common industry mitigation measures include retrieval-augmented generation (RAG), mandatory source citation, and constraining model output within predefined schemas. Cloudflare goes one step further: rather than having the model "try to cite," it structurally makes it impossible to cite anything outside the evidence bundle.

The Division of Labor in a Specialized Agent Team

Cloudflare did not build a general-purpose security analysis agent, but instead has multiple agents each responsible for a narrow domain:

• Triage agent: classifies alert severity and routes to the appropriate investigation workflow
• Investigation agent: queries telemetry sources and assembles the evidence bundle
• Recommendation agent: generates response actions based on collected evidence
• Validation agent: cross-checks recommendations against historical false positive patterns

The agents coordinate through a shared context object. This object continuously accumulates evidence and reasoning steps; each agent appends its own findings, then passes the enriched context to the next stage.

The orchestration layer runs on Cloudflare Workers, which enables agents to access the same global network data that powers Cloudflare's edge services with low latency. An agent investigating a DDoS alert can query traffic patterns across more than 300 data centers without leaving the Workers runtime.

A shared context object is a coordination pattern in multi-agent collaboration, referring to a data structure that runs through the entire workflow and can be read, written, and appended to by all agents. Compared with message-passing collaboration, shared context reduces explicit communication overhead between agents and allows each stage to see the full evidence accumulation history for later auditing. But its risks are context bloat and contamination: if one agent writes erroneous or malicious content, subsequent agents may continue reasoning based on the polluted state. Cloudflare mitigates this through strong type constraints such as EvidenceBundle—evidence can only be appended as structured entries, and the recommendation agent cannot write new evidence, only cite existing entries, thereby balancing collaboration flexibility with data trustworthiness.

Orchestration Flow and State Management

The system's process for handling an inbound security alert can be summarized as follows: the triage agent performs deterministic classification first, the investigation agent collects evidence (without invoking an LLM), the recommendation agent analyzes based on the evidence, and finally the validation agent verifies against known false positive patterns. In the code, the structure is enforced through the EvidenceBundle type—each piece of evidence includes a source identifier, timestamp, query parameters, and the raw result set. The recommendation agent cannot create evidence out of thin air; it can only cite entries already present in the evidence bundle.

Long-running investigations use Cloudflare Durable Objects for state persistence. If an alert requires hours of analysis (waiting for additional telemetry data, correlating with external threat sources), the Durable Object maintains context across multiple agent invocations. The handoff logic has built-in retry policies and fallback paths: if the recommendation agent times out or returns an unparseable response, the orchestrator can route to a simpler rule-based fallback or escalate directly to a human analyst.

Durable Objects are a stateful compute primitive provided by Cloudflare. They guarantee that a specific object has only one instance running at any given time and can persist state to storage. This complements the stateless, short-lived model of ordinary Workers: Workers are suited to stateless request-response tasks, while Durable Objects are suited to scenarios that need to maintain sessions, locks, or accumulated state across multiple invocations. In security investigations, the analysis of an alert may span hours, during which it may need to wait for external threat intelligence, additional telemetry data, or human confirmation. A Durable Object provides a stable state container for each investigation, allowing the orchestrator to preserve context and perform retries across multiple agent invocations without relying on an external database or message queue to reconstruct state.

Observability and Audit Trails

Every agent step writes structured logs into Cloudflare's analytics pipeline, recording the agent type and version, input context snapshot, evidence artifacts accessed, LLM prompts and responses (where applicable), output context diffs, execution time, and token usage.

Managed defense analysts can see a timeline view of the agent reasoning process. They can click on any recommendation to drill into the evidence bundle, view the specific LLM prompt, and trace which telemetry queries returned which results. This audit chain is critical for tuning: when an agent produces a false positive, engineers can replay the context on a new version of the agent and compare outputs; when an agent misses a real threat, they can inspect which evidence was missing and add new telemetry sources.

Security Boundaries and Deployment Form

Each agent runs in an isolated Worker with restricted permissions. The investigation agent can query telemetry but cannot execute response actions; the recommendation agent can generate blocklists but cannot apply them; only the validation agent can promote recommendations to an executable state, and even then, high-impact operations still require approval from a human analyst. LLM API calls pass through a dedicated gateway that enforces rate limits, logs all prompts and completions, and strips sensitive data before sending to external model providers. Cloudflare uses this gateway to experiment with different models (GPT-4, Claude, internally fine-tuned models) without modifying agent code.

The entire system is deployed at the Cloudflare edge: Workers handle agent execution, Durable Objects maintain stateful investigation context, KV caches threat intelligence and historical false positive patterns, R2 stores evidence bundles and audit logs for the long term, and Analytics Engine provides real-time metrics and log aggregation. This deployment form means agents execute close to the telemetry sources. Traditional security operations tools aggregate logs into a centralized SIEM before analysis, whereas Cloudflare's agents query distributed data sources directly, reducing latency and eliminating data movement bottlenecks.

Cloudflare Workers is a serverless runtime running on Cloudflare's global edge network, based on V8 isolates rather than traditional containers, so cold starts are extremely low and billing is per request. KV is an eventually consistent key-value store, suitable for caching threat intelligence and false positive patterns—data that is read-heavy, write-light, and tolerant of brief staleness; R2 is object storage compatible with the S3 API with no egress fees, suitable for long-term retention of evidence bundles and audit logs; Analytics Engine is oriented toward high-cardinality time-series data and supports real-time aggregation and querying of agent step logs. Using these primitives in combination means the system does not need to build its own cross-region data replication and storage layer, and agents can execute queries close to telemetry sources, avoiding the data movement costs and latency caused by the "centralize first, analyze later" approach in traditional SIEM architectures.

Failure Modes and Trade-offs

The system degrades gracefully when components fail. When the LLM API times out, it falls back to a rule-based heuristic after 10 seconds; when an evidence query times out, it outputs a partial analysis with a confidence penalty; when a Durable Object is unavailable, it retries with exponential backoff and escalates to a human after three attempts; when agent output is unparseable, it logs the error and flags it for human review; when the validation agent rejects a recommendation, it presents the rejection reason and evidence bundle together to the analyst. The evidence-first architecture limits the blast radius—if the recommendation agent hallucinates, the validation agent catches it because the recommendation cannot cite supporting evidence; if the validation agent itself fails, the system defaults to human review rather than automatically executing suspicious actions.

This architecture has clear costs. Evidence separation adds latency—collecting telemetry before invoking the LLM means longer processing time per alert, and Cloudflare accepts this trade-off because in security operations accuracy matters more than speed. Specialized agents add complexity—a single general-purpose agent is simpler to build and maintain, but specialization improves accuracy and makes tuning easier; when the triage agent misclassifies, only that agent needs retraining without affecting investigation or recommendation logic. Workers deployment limits model choice—running at the edge means it is impossible to use large local models that require GPU clusters, and LLM calls are routed to external APIs, introducing dependence on third-party availability and rate limits.

Technical Assessment

This pattern applies to domains where hallucination is unacceptable: security operations, financial fraud detection, medical diagnostic assistance, and any workflow where recommendations must be auditable and grounded in verifiable facts. It is not suitable for real-time response scenarios requiring sub-second latency, nor for environments where the evidence sources themselves are slow to query—the overhead of a multi-stage pipeline may be unacceptable in latency-sensitive scenarios.

If you are already running on the Cloudflare platform, or if telemetry sources are globally distributed, the advantages of the Workers deployment form are fully realized; if data is centralized in a single data center, the advantage of edge execution disappears. This architecture performs best when there is high-quality structured telemetry and a need to combine LLM reasoning with full auditability, and it is over-engineering for low-risk automation scenarios where occasional errors are acceptable.

Source: Cloudflare Blog: Building an evidence-grounded agentic security operations harness

One-line Summary

Cloudflare separates deterministic evidence collection from LLM reasoning to build an auditable edge security agent team.

Paragraph Summary

In its managed defense service, Cloudflare proposes an evidence-first agentic security operations architecture whose core is completely separating deterministic evidence collection from LLM reasoning. The system consists of four types of specialized agents—triage, investigation, recommendation, and validation—running on Cloudflare's Workers edge network and collaborating through a shared context object. LLMs can only cite entries in the already-collected evidence bundle, preventing hallucination at the architectural level. Every agent step writes structured audit logs, and analysts can trace the complete reasoning chain. Agents run in permission-isolated environments, high-impact operations require human approval, and LLM calls pass through a dedicated gateway that strips sensitive data. The architecture trades latency and complexity for accuracy, making it suitable for high-risk scenarios where hallucination is unacceptable.