# How Cloudflare Enforces Engineering Standards Using AI

> Cloudflare turned its engineering standards into a machine-readable RFC corpus that AI reviewers query, blocking merges only on rules promoted to enforced.

Published: 2026-08-06
URL: https://daniliants.com/insights/how-cloudflare-enforces-engineering-standards-using-ai/
Tags: cloudflare, code-review, ai-agents, ci-cd

---

## Summary

Cloudflare replaced scattered engineering documentation with the "Codex", a single governed, machine-readable knowledge base of standards written as RFCs using RFC 2119 keywords (MUST/SHOULD). Three AI agents (code reviewer, spec reviewer, incident report reviewer) query this Codex to enforce standards automatically, and each rule only becomes merge-blocking after an explicit "approved to enforced" promotion step.

## Key Insight

- **Scale of impact (4 months of code reviewer)**: roughly 230,000 violations flagged, roughly 16,000 caused a blocked merge (only the ones tied to MUST statements on RFCs marked "enforced", not merely "approved").
- **Compaction is the real engineering problem, not the LLM call.** With 60+ RFCs and growing, feeding the full corpus into every review blew the context window and degraded results. Cloudflare built a dedicated extraction agent that compresses each RFC into a JSON structure of atomic statements (slug, section, level, text, href); full RFC bodies are loaded only when an agent needs more context. They started with a plain Markdown digest and moved to structured JSON specifically so agents could filter more precisely.
- **Stable slug IDs per statement** persist across RFC edits, which is what makes longitudinal tracking, analytics, and exception-handling possible. Otherwise every doc edit would orphan the enforcement history.
- **A two-stage lifecycle (approved, then enforced) decouples publishing from blocking.** New standards start as non-blocking recommendations the moment they are approved; someone must explicitly promote a rule to "enforced" before an unmet MUST can withhold approval or block a merge. This buys teams adaptation time without freezing standards adoption.
- **Full agent review is slow (minutes), so they added two cheaper layers**: language-specific linters (oxlint for TypeScript, Rust next) for standards that are mechanically checkable, giving millisecond feedback, and a local CLI that runs the same agent stack as CI against your diff, cutting the CI round-trip.
- **Spec and incident reviewers run on shared infrastructure**, not bespoke pipelines: Cloudflare Worker plus D1 for state plus AI Gateway for model routing plus Cron Trigger for scanning. Since May 2026: roughly 600 unique specs reviewed (3,200+ total invocations, including reruns), severity split 65% major, 29% minor, 6% critical. 200+ incident reports reviewed, 93% of those low-impact, internal, or preemptive. For high-severity incidents the reviewer is mandatory and reports are not "complete" until findings are addressed.
- Common failure modes the incident reviewer catches: missing follow-up action items, incomplete timelines, and omitted detection signals. The same three gaps that quietly erode postmortem quality in any org that does not check for them systematically.