The truly programmable SASE platform (opens in new tab)

Cloudflare argues that true SASE programmability goes beyond APIs, Terraform, webhooks, and alerts. It means intercepting security events, enriching them with external context, and making real-time decisions through custom logic. By running Cloudflare One and its Developer Platform on the same global edge network, Cloudflare aims to let customers apply programmable, low-latency policies without stitching together separate infrastructure.

What “Programmability” Means

• Traditional programmability supports configuration and automation, such as sending Slack alerts when policies trigger.
• True programmability allows security systems to:
  • Inspect an event before access is granted.
  • Query external systems for additional context.
  • Make or change an access decision in real time.
• Example: a request to a regulated application could be checked against a learning management system to confirm that the user’s compliance training is current. Expired or missing certification would result in denial and redirection to training.

Cloudflare’s Programmable SASE Architecture

• Cloudflare’s network spans more than 330 cities and reaches approximately 95% of Internet-connected users within 50 milliseconds.
• Cloudflare One and the Developer Platform run on the same infrastructure and use shared network primitives.
• This enables Workers to extend inline services such as Access without requiring separate cloud infrastructure.
• Customers can:
  • Call external risk APIs.
  • Add dynamic request headers.
  • Validate browser attributes.
  • Route traffic according to custom business logic.
• Running custom logic at the edge reduces latency and avoids the operational overhead of webhook-based integrations and disconnected systems.

Custom Actions in Security Policies

• Conventional gateways generally limit policy outcomes to actions such as allow, block, isolate, or quarantine.
• Cloudflare is expanding policies to support managed and custom actions.
• Potential uses include:
  • Injecting headers based on user identity claims.
  • Obtaining real-time verdicts from external risk engines.
  • Restricting access based on location or working hours.
  • Updating risk lists based on scheduled analysis of user activity.
• Custom actions can invoke a Worker when a Gateway HTTP policy matches, giving the code access to request context and allowing decisions in milliseconds.
• Managed actions will offer templates for common use cases such as IT service management, redirects, and compliance workflows.

Automated Device Session Revocation

• One customer needed periodic re-authentication for Cloudflare One Client users, similar to traditional VPN session expiration.
• Cloudflare’s built-in session controls were application-specific rather than global and time-based.
• The customer implemented a scheduled Worker that:
  • Queries the Cloudflare Devices API.
  • Handles cursor-based pagination to retrieve registrations.
  • Calculates how long each device has been inactive.
  • Deletes registrations exceeding a configured inactivity threshold.
  • Forces affected users to authenticate again through their identity provider.
• The example also supports environment-based configuration and a dry-run mode for testing before revocations are applied.

Cloudflare’s recommendation is to treat SASE policies as programmable decision points rather than fixed allow-or-block rules. Combining Cloudflare One with edge Workers can provide faster, more context-aware security automation while reducing integration complexity.