Let the user change the app without making them maintain the whole thing

There is an appealing middle ground between a rigid SaaS product and everyone maintaining their own generated application: keep a supported core, then let users add the missing behavior.

Morrell argues that LLMs reduce the cost of writing those extensions, while modern isolation makes running them more practical. The difficult part becomes deciding exactly what an extension may do.

Handing it an API key is broad authority. Handing it a function that reads one approved email is much narrower. The host keeps the credential and exposes only the operation it intended to permit.

The same discipline applies to resources. An extension needs limits on memory, CPU, network traffic and logs, as well as isolation from other users. Code that generates infinite log output can be a production problem without being sophisticated or malicious.

Morrell works at Cloudflare, so his platform perspective is relevant context. The larger product idea travels beyond any vendor: a service can remain responsible for reliability while giving users room to make it fit their own work.