Sterling Synthesis · July 2026
Everything from three separate AI research sessions, merged into one strategic document. 128+ capabilities, pricing, architecture, and a concrete roadmap for OA.
Every capability across all three research sessions. Source badges show which AI found each item. OA relevance rated High / Medium / Low.
How to read source badges
Sterling = Claude Playbook. Gemini = Google Gemini Deep Dive. ChatGPT = ChatGPT 5.6 Expert Guide. All = covered by multiple sources.
The products you write apps on. This is OA's primary layer.
Upload code and it runs across 335+ cities. No servers to manage. Sub-millisecond cold starts thanks to V8 Isolates (thousands of apps share one OS process, each securely sandboxed). Over 3 million developers. 40%+ of Y Combinator's Winter 2025 cohort built on it.
Pricing: Free tier: 100K requests/day. Paid: $5/mo base includes 10M requests + 30M CPU-ms. Then $0.30/M requests, $0.02/M CPU-ms. No bandwidth charge.
Key insight (Gemini): Billed on CPU time, not wall time. A Worker that waits 10 seconds for an API but uses 10ms of actual CPU is billed for 10ms. Massive savings for AI agents that spend most time waiting.
OA relevance: High — the engine behind every app we build.
Deploy frontend sites with automatic CI/CD from Git. Supports server-side functions alongside static assets. Where the UI lives for all our dashboards.
OA relevance: High — every client dashboard, research page, and internal tool is on Pages.
SQLite-based. Store structured data: users, tasks, orders, permissions. Strong consistency on primary, eventual on read replicas.
Limits: 50,000 databases per account. 10 GB per database. 5 GB free.
OA relevance: High — every app's data layer.
S3-compatible file storage. PDFs, images, videos, backups. Zero egress fees, forever. 10 TB of files/month on AWS S3 costs ~$900 in egress alone. R2: $0.
Pricing: $0.015/GB/mo storage. Free tier: 10 GB + 1M Class A ops.
OA relevance: High — client document vaults, media pipeline, backups.
Ultra-fast globally distributed storage for settings, feature flags, cached lookups. Eventually consistent (60-second propagation).
OA relevance: Medium — tenant branding, config, feature flags.
Each DO has a stable identity, its own private SQLite database, and WebSocket support. Single-threaded for consistency. WebSocket hibernation means millions of idle connections cost virtually nothing.
OA relevance: High — real-time collaboration, AI agent state, live dashboards.
Queues: Background job processing. User doesn't wait while heavy tasks run behind the scenes.
Workflows: Durable multi-step processes. If step 4 of 7 fails, it resumes from step 4. GA. Perfect for onboarding pipelines.
Containers: GA since June 2025. Run heavier software that doesn't fit the lightweight Workers model.
OA relevance: High — onboarding flows, report generation, document processing.
Workers for Platforms: Let your customers deploy isolated code on your platform. Each OA client can have custom business logic without a separate server fleet.
Cloudflare for SaaS: Serve many customers on their own branded domain with auto-SSL. portal.clientname.com just works.
OA relevance: High — the multi-tenant backbone for client dashboards and agent products.
Route incoming email for free. Send transactional email (receipts, password resets) from Workers. 3,000 emails/day included in $5/mo plan.
OA relevance: Medium — client notification emails, onboarding sequences.
The fastest-growing area. Directly relevant to OA's agentic product vision.
50+ models (Llama, Mistral, Qwen, DeepSeek, Flux, BGE). One API call, no GPU to rent. Running in 200+ cities. 60-90% cheaper than OpenAI for tasks a smaller model handles well.
Pricing: 10,000 Neurons/day free. $0.011 per 1K Neurons paid.
OA relevance: High — AI features in every client product at low cost.
Sits in front of Workers AI, OpenAI, Anthropic, Google, Groq. Caches responses, controls costs, retries failures, falls back between providers, logs everything. One dashboard for all AI spend.
OA relevance: High — cost control and provider flexibility for every AI feature.
Agents SDK: Framework for building autonomous AI agents. Each agent is a Durable Object with stable identity, SQLite memory, WebSocket connections, and built-in scheduling.
Project Think (@cloudflare/think): A higher-level, opinionated agent harness discovered by Gemini. Auto-wires message history persistence, stream resumption, and tool orchestration. Capability-based authorization means the agent starts with zero access and must be explicitly granted tools.
Capability Execution Ladder (Tiers 0-4):
| Tier | What It Does |
|---|---|
| 0 - Workspace | Local file operations backed by SQLite + R2 |
| 1 - Dynamic Worker | Write and run code in a sandboxed V8 Isolate (zero network) |
| 2 - npm Packages | Dynamically install npm libraries, compiled on-the-fly |
| 3 - Web Automation | Spin up headless Chrome to interact with websites |
| 4 - Sandbox | Full secure OS container: clone repos, compile, run tests |
OA relevance: High — the foundation for every AI agent product we sell.
Point it at an R2 bucket of documents. It automatically indexes them, keeps them in sync, and lets an AI answer questions grounded in your files. Supports external models (OpenAI, Anthropic).
OA relevance: High — "chat with your SOPs" for every client. The core of most business AI tools.
Stores the "meaning" of text as numbers so you can search by concept, not just keywords. Free tier: 30M queried dimensions/mo, 5M stored.
OA relevance: High — agent memory, document search, relationship intelligence.
Runs headless Chrome on Cloudflare. The agent writes JavaScript CDP commands against the browser. Key features:
OA relevance: High — could replace our entire Mac Mini Puppeteer dependency. The human-in-the-loop pattern solves the Facebook login problem.
Cloudflare launched the industry's first remote MCP server (April 2025). MCP is the standard that lets AI agents securely connect to external tools and data. Cloudflare handles authentication (Auth0, Stytch, WorkOS) so users can safely grant an agent permission to act on their behalf.
OA relevance: High — agents that can interact with client's existing software.
WebMCP: An open standard for websites to declare their APIs for AI agents. Instead of scraping, agents discover structured endpoints.
x402: Machine-to-machine payment protocol (with Coinbase). Agents use micropayments to buy API access, compute, or data on the fly.
@cloudflare/codemode: Secure sandboxed environments where agents write and execute code safely. Zero network access in the sandbox.
OA relevance: Medium — forward-looking. WebMCP will matter when adoption grows. x402 is not immediately actionable.
The classic Cloudflare. Free or included on all plans.
All the foundational security and performance. CDN in 335+ cities. World's fastest public DNS (1.1.1.1). Unmetered DDoS protection (47.1M attacks mitigated in 2025, up 121% YoY). WAF blocks hacking attempts. Free SSL. Bot management and Turnstile (free invisible CAPTCHA).
OA relevance: High — every site and app gets this automatically.
Put a login wall in front of any app. Control who gets in by email, Google login, or device. Free for up to 50 users. $7/user/mo after that.
Includes: Gateway (traffic filtering), Browser Isolation, CASB (SaaS security scanning), DLP (data leak prevention), WARP (device agent).
OA relevance: High — client and employee login for every dashboard.
Stream: Upload, encode, store, protect, and deliver live or recorded video. Training videos auto-adapt to each device.
Images: Store, resize, and optimize images on the fly.
Realtime: Low-latency audio/video for meetings and collaboration (SFU, TURN, RealtimeKit).
Web Analytics: Privacy-first traffic stats without cookies.
OA relevance: Medium — Stream for training content, Images for client dashboards.
Full capability count
ChatGPT cataloged 128 named capabilities across 12 categories. The Sterling Playbook covered ~30 in plain English with pricing. Gemini discovered 5 capabilities not in either (Project Think, Browser Run Human-in-the-Loop, WebMCP, x402, Code Sandboxes) plus 2 acquisitions (Human Native, Astro). This tab merges all three into one reference.
Building blocks for pitching Cloudflare-based solutions to OA clients. Pick a client need, get the architecture and pitch.
Client need: "I want to see my team's KPIs, download reports, and manage tasks in one place."
Architecture: Pages (frontend) + Workers (API) + D1 (data) + R2 (file storage) + Access (login)
Monthly cost: $5-50 depending on usage. If using Access beyond 50 users: +$7/user.
Pitch line: "A private, branded dashboard on your own domain with secure login, real-time KPIs, and document storage. No Google Sheets. No shared folders. Just your data, your way."
Client need: "My team wastes hours searching for SOPs and procedures."
Architecture: Pattern 1 + AI Search (pointed at R2 bucket of SOPs) + Workers AI or AI Gateway
Monthly cost: $20-100 depending on document volume and query frequency.
Pitch line: "Upload your SOPs and procedures. Your team asks questions in plain English and gets answers sourced from your own documents, with page references."
Client need: "I want an AI that monitors my email and CRM, drafts follow-ups, and schedules tasks."
Architecture: Agents SDK (or Think) + Durable Objects + AI Gateway + Remote MCP servers + Vectorize
Monthly cost: $50-200 depending on agent complexity and AI model usage.
Pitch line: "An AI agent that works 24/7, connected to your email and business tools. It drafts, schedules, and acts on your behalf, with your approval before any action."
Client need: OA builds a product once, sells it to many clients with isolation.
Architecture: Workers for Platforms + Cloudflare for SaaS (custom domains) + separate D1/KV/R2 per tenant
Monthly cost per tenant: $5-20 at the infrastructure level. Price to client: $100-500/mo with healthy margins.
Pitch line: "Each client gets their own private environment on their own domain. Your data never touches another client's data."
Pricing advantage to emphasize
Cloudflare does not charge egress fees. A client serving 10 TB of documents per month would pay ~$900 just in AWS bandwidth fees. On Cloudflare: $0. This is the single biggest cost differentiator in any proposal.
How Outsource Access should use Cloudflare internally. Replace spreadsheets, secure internal tools, and power internal AI.
Currently using custom auth tokens per dashboard. Gemini's recommendation: migrate to Cloudflare Access (Zero Trust) for proper identity-aware auth with Google login integration. Free for up to 50 users.
Benefits: one login across all internal tools, audit logs of who accessed what, device posture checks, no custom token management.
Estimated monthly cost for OA internal
Workers $5/mo base + D1 (included) + R2 ~$5-10/mo for document storage + Access $0 (under 50 internal users). Total: ~$10-15/mo for the entire internal platform. Compare to a single SaaS tool subscription.
AI agent products for OA's staffing clients. The revenue opportunity.
OA already provides human VAs to clients. The next step: pair each VA with an AI agent that handles the repetitive work, letting the human VA focus on judgment calls and relationship work. The agent runs 24/7 on Cloudflare. The VA manages exceptions and approvals.
Inbound event (email, chat, webhook, schedule) triggers the agent. Here's the full stack:
| Layer | Cloudflare Product | What It Does |
|---|---|---|
| Agent Runtime | Think / Agents SDK + Durable Objects | Persistent identity, SQLite memory, WebSocket connections, scheduling |
| AI Models | Workers AI + AI Gateway | Mix cheap local models with frontier models (OpenAI, Anthropic). Cost control. |
| Knowledge Base | AI Search + Vectorize + R2 | Agent answers questions from client's own documents |
| External Tools | Remote MCP Servers | Agent connects to email, CRM, calendar with proper auth |
| Browser Actions | Browser Run | Agent navigates websites lacking APIs. Human-in-the-loop for login/captcha. |
| Code Execution | @cloudflare/codemode | Agent writes and runs code for data analysis, report generation |
| Client Login | Access or Cloudflare for SaaS | Each client gets their own branded login portal |
| Data Isolation | Separate D1 + R2 per tenant | Client A's data never touches Client B's data |
From Gemini's research. Each agent starts with zero permissions and must be explicitly granted capabilities:
This maps perfectly to selling different agent tiers to different clients. A basic client gets Tier 0-1. A premium client gets Tier 0-3.
Your underlying Cloudflare cost per client at moderate scale:
| Component | Monthly Cost |
|---|---|
| Workers compute | $5-20 |
| D1 database | $1-5 |
| R2 document storage | $2-10 |
| AI model inference | $20-100 |
| Browser hours (if Tier 3) | $5-50 |
| Total infrastructure per client | $33-185 |
Price to client: $200-500/mo per agent seat. That's 60-85% margin on infrastructure alone, before counting the VA management revenue.
The pitch to clients
"Your VA is great at judgment, relationships, and nuance. But they spend 60% of their time on repetitive data entry, email sorting, and status updates. Our AI agent handles that 60% around the clock, so your VA focuses on the 40% that actually grows your business. The agent is $X/mo. Your VA's impact doubles."
Brad's personal products and how Cloudflare powers them. Architecture blueprints from Gemini's research, cross-referenced with what we've already built.
Current state: Pages + D1 + Workers Functions. Manual refresh/polling. Gmail API for email data.
Gemini's upgraded architecture:
Current state: Pages + D1 + Workers. Family calendar, tasks, chores.
Gemini's upgraded architecture:
Current state: WordPress site on Cloudways (dugoutready.com).
Gemini's Cloudflare-native architecture:
This is the architecture for the full product build whenever the WordPress site graduates to a real app.
Current state: brads-command-center.pages.dev (app) + lanewise.ai (landing page)
Potential additions: Agents SDK for an AI productivity coach that proactively suggests focus blocks based on calendar and energy patterns. Durable Objects for live collaboration if Lanewise ever goes multi-user.
Brad has both Google Workspace Enterprise (340 licenses + 120 Gemini Enterprise) and Cloudflare. They serve different roles.
| Dimension | Cloudflare | |
|---|---|---|
| Core strength | Data, identity, device management, email, docs, calendar | Execution, hosting, AI agent runtime, edge security |
| Best for | System of record (who people are, what they wrote, when they meet) | System of action (run code, serve apps, deploy agents) |
| AI approach | Gemini Enterprise: Agent Designer, connected data stores, Deep Research | Workers AI: serverless inference, Agents SDK, AI Gateway |
| Auth | Google Identity (SSO, Workspace accounts) | Access (consumes Google Identity, adds policy) |
| Storage | Google Drive (collaboration, sharing, real-time editing) | R2 (bulk files, $0 egress), D1 (structured data) |
| Pricing model | Per-user/mo ($12-25/user for Workspace, Gemini add-on) | Usage-based ($5/mo base, pay for what you use) |
| HIPAA | Clear BAA across dozens of services | BAA is Enterprise-only, developer products not publicly confirmed |
The routing rule
Google = data, identity, collaboration. Use it as the source of truth for who people are, what they wrote, and when they meet. Cloudflare = execution, hosting, agents. Use it to build, deploy, and run everything that faces a browser or runs autonomously.
Two Cloudflare accounts, clear separation rules, and multi-tenant design.
| Account | ID | What Goes Here |
|---|---|---|
| Brad Personal (DEFAULT) | f80e8ac3dae61d519e12427b58f8bd4d | All Sterling-built pages, dashboards, research, personal projects (Command Center, Lanewise, Family Planner), BST sites |
| OA Team | 79bf9918da35fa3f7d3a0bca83c0d0be | Client dashboards, server.outsourceaccess.com, OA portal ecosystem, employee dashboards, anything under outsourceaccess.com |
cloudflare-api-token. OA = Keychain cloudflare-oa-api-token.When building a product that serves multiple OA clients:
This architecture ensures client A's data, code, and files are completely isolated from client B's. No shared database tables, no shared file paths, no cross-tenant data leakage.
HIPAA reminder
Both accounts are on commercial Cloudflare. If any client handles patient health data (PHI), get written BAA confirmation from Cloudflare Enterprise sales that Workers, D1, and R2 are covered before building. All three source reports agree on this.
A phased rollout plan synthesized from all three research sessions.
Goal: Prove the core pattern works and establish internal confidence.
Benchmark to advance: The dashboard works, the team logs in with Google, and total cost is under $20/mo.
Status: Largely done — Command Center, client dashboards, and Sterling Media are already running. Access migration is the remaining item.
Goal: Layer AI capabilities onto the existing infrastructure.
Benchmark to advance: A paying or pilot client uses an AI feature daily.
Goal: Turn the repeatable architecture into a sellable SaaS product.
Benchmark to advance: Multiple paying clients on the multi-tenant platform.
Goal: Expand the agent offering and build competitive moats.
Guardrails that change the plan
HIPAA: If any client needs real PHI handling, stop and get written BAA confirmation from Cloudflare Enterprise sales. Alternatively, keep PHI on Google Cloud or AWS and use Cloudflare only for the security front door.
Heavy compute: If an app needs a traditional always-on server or full Postgres, pair Cloudflare with Supabase (Postgres + auth) or Fly.io. Don't force it onto Workers.
Backups: Always keep D1 and R2 backups off-platform. Given the late-2025 and early-2026 outages, a Cloudflare outage should be an inconvenience, not a catastrophe.
| Product | Cloudflare Stack | Phase |
|---|---|---|
| Internal dashboards | Pages + Workers + D1 + Access | 1 (done) |
| Document Q&A / SOP search | AI Search + R2 + Workers AI | 2 |
| Daily briefing agent | Agents SDK + AI Gateway + Vectorize | 2 |
| Client agentic product | Think + Workers for Platforms + D1 + R2 | 3 |
| DugoutReady (real-time) | D1 + Durable Objects + Workers AI | 4 |
| Family Planner AI | R2 + Workers AI + Vectorize | 4 |