Access policies and WAF-lite
Two separate layers
Identity access
Controls who may enter an app.
Selectors:
- Authenticated or public
- Organization membership
- Identity provider
- Entra app role
- intrnl group
- Network/IP list
- App environment
- User/platform role
Traffic security
Controls request characteristics.
Selectors:
- Source IP
- Path
- Method
- Request size
- Rate
- Header presence
- Host/environment
- Future country/ASN
Actions:
Allow
Block
Require authentication
Require group
Require network list
Rate limit
Log
Named IP lists
Organization administrators create reusable lists:
Organization Offices
- 203.0.113.14/32 Main office
- 198.51.100.0/24 VPN egress
- 2001:db8::/48 Office IPv6
Entry fields:
address or CIDR
display name
description
optional expiration
created by
created at
last updated by
Lists may mix individual IPv4/IPv6 addresses and CIDR ranges, following the useful model established by Cloudflare custom lists. Cloudflare IP lists
Show administrators:
- Which policies reference a list
- Which apps are affected
- Validation/normalization result
- Expired or overlapping entries
- Complete change history
Access profiles
User-facing presets:
Private to creator
Organization users
Organization users + approved networks
Specific groups
Administrators only
Public
Custom
“Public” is unavailable unless the organization permits public applications.
Mandatory organization rules
Separate:
- Organization defaults
- Organization-mandatory constraints
- App-level settings
An app owner may override a default only if delegated permission allows it.
An app owner cannot weaken a mandatory rule.
Example:
Organization requirements:
- Entra authentication
- internal only
- no public apps
- no regulated data
- no unrestricted egress
Equipment Requests app:
- Operations group
- Organization Offices IP list
Policy evaluation order
A deterministic order:
- Validate route and active app/environment.
- Apply organization suspension/deny state.
- Apply mandatory global network deny rules.
- Apply coarse abuse/rate controls.
- Resolve or establish identity if required.
- Apply organization mandatory identity rules.
- Apply application access profile.
- Apply path/method/body-size rules.
- Apply app-specific rate limits.
- Forward to runtime.
Policy changes are versioned.
A deployment record references the policy version active at deployment time.
Security-policy changes that expand access can require approval even when code does not change.
What WAF-lite is not
V1 does not claim parity with a complete managed WAF.
It does not initially include:
- Managed CVE signatures
- Advanced bot management
- Full expression-language compatibility
- Browser challenge systems
- DDoS scrubbing
- Machine-learning anomaly detection
- Every Cloudflare field/action
The outer edge can still provide commodity DDoS/WAF protection, while intrnl provides organization-aware internal-app policy.