Cloudflare published a proposal this month for what it calls an Agent Development Lifecycle, or ADLC. The pitch: AI models write code fine now, but testing, deployment, and maintenance still run at human speed. The company wants to replace the pipeline with a workflow that spawns agents and routes failures into new tasks.
The core primitive is Cloudflare Workflows. A traditional CI job moves a known set of steps from source control to production. A workflow can branch based on what each step returns. It can spin up containers, run headless browsers, dispatch subagents, and preserve state across long-running work. Cloudflare built @cloudflare/ci on top of this, which chains execution steps and handles credentials inside the workflow context.
That distinction matters. A pipeline assumes the set of steps is known before the run starts. A workflow does not. An agent investigating a failed test can pull logs and propose a fix, or hand the problem to a different agent with a different capability. The next action depends on what the last one found.
Observability is where this gets uncomfortable
Infrastructure telemetry will not tell you why an agent deployed the wrong thing. CPU graphs and request latency show you what the system did. They do not show you which tool the model called, what argument it passed, or where a subagent handoff changed the task direction.
Cloudflare's answer is an observability dashboard with OpenTelemetry-compatible traces for model calls, tool executions, and token consumption. You can replay a session, inspect handoffs, and look at malformed arguments from one trace instead of reconstructing the run from application logs. It integrates with Think, Flue, and the AI SDK.
Token usage as a deployment metric is the more interesting piece. A workflow can pass every functional test and still be unacceptable if an agent loops on tool calls or ships half the codebase into a context window. Cost becomes a release gate. That is a real shift from how most teams treat CI, where a green check mark ends the story.
The security model is the part worth stealing
Cloudflare is not relying on prompt instructions to keep agents in bounds, which is correct. An agent can take hostile input through a repository or a test fixture. Once that input is in the context, you cannot talk the model out of acting on it.
The Agent Access Model issues short-lived credentials scoped to a task, with a capability ceiling. A credential might allow a preview deployment and a test database while blocking production writes, secret export, and access to unrelated repositories. Short expiration limits the damage if a token leaks, but it also means workflows must renew access through an auditable policy path. That is operational overhead teams will feel on day one.
The Trust Ratchet is the unusual piece. When an agent touches a protected resource, its capabilities get reduced. The goal is to stop lateral movement after an agent has handled malicious data. I have not seen this pattern in production tooling before. It is a reasonable response to the problem, though I would want to watch how it behaves when an agent legitimately needs elevated access across a long-running workflow. Repeated ratcheting could strand a task halfway through a deploy.
The factory floor is already here, in a different form
LS Electric put two Boston Dynamics Spot robots into regular operation at its Busan plant this month. The robots patrol the factory floor, check chamber door seals with thermal cameras, and collect heat, noise, and vibration data from pumps, motors, and control panels. The company ran a two-month trial starting in July with Hyundai Autoever before making the deployment permanent. It plans to build an AI analysis model from the Busan data and expand to other sites in Korea and abroad.
That deployment is a useful contrast to the ADLC pitch. Spot is doing physical inspection in a controlled environment. The blast radius of a mistake is bounded by the robot's body and the floor plan. An agent with a deployment credential has a much larger blast radius, and the mistake might be a single API call that writes to the wrong database.
The lessons transfer anyway. Isolated task execution and rollback rules for atomic changes apply to both. LS Electric spent two months on a trial before committing. Cloudflare's proposal assumes teams will build this infrastructure from scratch, which is a much bigger ask than buying two robots.
What to actually do
If you run CI today and you are thinking about agents, start with the credentials. Task-bound tokens with short expiry and a hard capability ceiling are useful whether or not you adopt the rest of ADLC. The second piece is tracing. If you cannot replay a model call, you cannot debug an agent failure, and you cannot put a token budget on a workflow.
The rest of the proposal is early. Cloudflare says the model depends on reliable evaluations, traceable tool use, strong isolation, and credentials that expire before an agent reaches unrelated systems. Those are all hard problems, and the company is not claiming to have solved them. What it has done is define the unit of automation as the workflow plus its agent calls plus its credentials plus its production evidence. That framing is more useful than another code-generation demo, and it puts the engineering work in orchestration, observability, and access control, where it actually belongs.
If you are evaluating this for a team, the practical starting point is a small workflow that runs one agent against a preview deployment with a scoped token. Measure the token cost per task. Then decide whether the model earns more scope.