--- title: How Cloudflare enforces engineering standards using AI description: Cloudflare built the Cloudflare Codex, a governed body of engineering standards in RFC format that AI agents consume across the development lifecycle. Over... canonical: https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Cloudflare enforces engineering standards using AI | daily.dev og:description: Cloudflare built the Cloudflare Codex, a governed body of engineering standards in RFC format that AI agents consume across the development lifecycle. Over... og:url: https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy og:image: https://api.daily.dev/og/posts/0ranTYmPy.png og:image:alt: How Cloudflare enforces engineering standards using AI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Cloudflare enforces engineering standards using AI **[Cloudflare](https://daily.dev/sources/cloudflare)** · 9 min read · 0 upvotes · 0 comments ## Summary Cloudflare built the Cloudflare Codex, a governed body of engineering standards in RFC format that AI agents consume across the development lifecycle. Over four months, an AI code reviewer flagged ~230,000 standard violations and blocked 16,000 merges, while a spec reviewer agent evaluated ~600 technical designs before implementation. Standards are structured as JSON with SHOULD/MUST keywords, enabling agents to filter relevant rules without overwhelming context windows. Three agents currently consume the Codex: a code reviewer integrated into CI (with CLI and linter alternatives), a spec reviewer running on Cloudflare Workers/D1, and an incident report reviewer for postmortems. Future plans include extending coverage across the full SDLC and expanding the Codex to product, security, and compliance teams. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Cloudflare use AI to enforce engineering standards across code reviews? Cloudflare built the Codex, a governed set of RFC-style engineering standards using MUST and SHOULD keywords, which an AI code reviewer agent retrieves and applies during merge requests. Over four months it flagged nearly 250,000 violations and blocked about 16,000 merges once RFCs reached the enforced lifecycle state, while approved-but-not-yet-enforced RFCs generate only non-blocking recommendations. _See how daily.dev surfaces engineering practices like automated standards enforcement for teams weighing similar workflows._ ### What is the difference between approved and enforced status for a Codex RFC at Cloudflare? Approved RFCs can already be flagged by Codex agents as violations, but they only block merges once promoted to the enforced state. This separate promotion step gives teams time to absorb new requirements before failures start blocking work, and accommodates cases needing more enforcement tooling before rules become mandatory. _Track how teams stage rollout of automated code review rules by following backend engineering practices on daily.dev._ ### Why did Cloudflare add local linters and a CLI alongside its AI code reviewer? A single AI code reviewer run takes a couple of minutes due to coordinator and sub-agent execution, so Cloudflare added custom linter configuration packages (starting with TypeScript using oxlint) for mechanically verifiable rules that surface in milliseconds, plus a CLI built on OpenCode to run the same review agents locally and skip the CI round trip. _Developers weighing AI review latency against fast local linting can follow these agentic workflow tradeoffs on daily.dev._ ## Similar posts on daily.dev - [Orchestrating AI Code Review at scale](https://daily.dev/posts/orchestrating-ai-code-review-at-scale-re4wh2np4) · Cloudflare · 0 upvotes · 0 comments - [AI Code Review at Scale: LinkedIn's Multi-Agent Approach](https://daily.dev/posts/ai-code-review-at-scale-linkedin-s-multi-agent-approach-7lpkuhkzi) · InfoQ · 0 upvotes · 0 comments - [Your Standards Exist. They Just Aren't Followed.](https://daily.dev/posts/your-standards-exist-they-just-aren-t-followed--pcppxk9zy) · Earthly · 0 upvotes · 0 comments - [Building shared coding guidelines for AI \(and people too\)](https://daily.dev/posts/building-shared-coding-guidelines-for-ai-and-people-too--5kqpht1om) · Stack Overflow Blog · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#cloudflare](https://daily.dev/tags/cloudflare), [#code-review](https://daily.dev/tags/code-review) [View this post on daily.dev](https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Cloudflare enforces engineering standards using AI","url":"https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy"},"datePublished":"2026-08-04T13:03:23.497Z","dateModified":"2026-09-14T09:30:54.141Z","description":"Cloudflare built the Cloudflare Codex, a governed body of engineering standards in RFC format that AI agents consume across the development lifecycle. Over...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c38b48405562c8e00141f3c88aee7d1e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c38b48405562c8e00141f3c88aee7d1e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,cloudflare,code-review","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"How Cloudflare enforces engineering standards using AI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-cloudflare-enforces-engineering-standards-using-ai-0rantympy#faq","mainEntity":[{"@type":"Question","name":"How does Cloudflare use AI to enforce engineering standards across code reviews?","acceptedAnswer":{"@type":"Answer","text":"Cloudflare built the Codex, a governed set of RFC-style engineering standards using MUST and SHOULD keywords, which an AI code reviewer agent retrieves and applies during merge requests. Over four months it flagged nearly 250,000 violations and blocked about 16,000 merges once RFCs reached the enforced lifecycle state, while approved-but-not-yet-enforced RFCs generate only non-blocking recommendations. See how daily.dev surfaces engineering practices like automated standards enforcement for teams weighing similar workflows."}},{"@type":"Question","name":"What is the difference between approved and enforced status for a Codex RFC at Cloudflare?","acceptedAnswer":{"@type":"Answer","text":"Approved RFCs can already be flagged by Codex agents as violations, but they only block merges once promoted to the enforced state. This separate promotion step gives teams time to absorb new requirements before failures start blocking work, and accommodates cases needing more enforcement tooling before rules become mandatory. Track how teams stage rollout of automated code review rules by following backend engineering practices on daily.dev."}},{"@type":"Question","name":"Why did Cloudflare add local linters and a CLI alongside its AI code reviewer?","acceptedAnswer":{"@type":"Answer","text":"A single AI code reviewer run takes a couple of minutes due to coordinator and sub-agent execution, so Cloudflare added custom linter configuration packages (starting with TypeScript using oxlint) for mechanically verifiable rules that surface in milliseconds, plus a CLI built on OpenCode to run the same review agents locally and skip the CI round trip. Developers weighing AI review latency against fast local linting can follow these agentic workflow tradeoffs on daily.dev."}}]} ```