Cloudflare Connect 2026 · System Sketch · Foundational →

Creating an infinite extensibility layer to your Secure Web Gateway

Leela Kanakala

Sr. Specialist Solutions Engineer — APJ

Giriraj Jayaraman

Principal Specialist Solutions Engineer — ANZ

The finite menu

The policy action menu

Two answers.

When neither is right, the menu has nothing else.

A controlled exception

The missing middle

Not a bypass.
Not a block.

A controlled exception could be:

Continue, after a reason.
Continue, after redaction.
Continue, temporarily.

0:02 — A:
“Someone asks for an exception. Most policy flows make you choose between two bad shapes: a broad bypass, often with no expiry; or a hard denial.”

“What is missing is the controlled middle. Let them continue after giving a reason. Let the request continue after removing the sensitive part. Or grant the exception temporarily and ask again later.”

“Right now the sharpest version of this is AI. Somebody pastes source code into a model. Block the domain — the business revolts within a day. Allow it — you’ve leaked. DLP-block it — they hit a wall, learn nothing, and find a different route in about ten minutes.”

B: “And notice what’s happening. Your gateway detected the thing correctly. Detection isn’t the problem. What you’re allowed to do about it is the problem.”

Quick beat — no slide, no board. 30–60 seconds, keep it moving.
B: “Quick one — anyone got an action you’ve personally wanted that wasn’t on the menu? One or two, shout it out.” Take 1–2 answers only.
[PM] B: “I’ll be honest about my own job — I get requests like that constantly. Most are completely reasonable and I will still never build them, because three of you need it and forty thousand of you don’t.”
[SME] B: “I’ve filed some of these myself. I know what happens to them.”

Transition (A): “So what if I gave you all of it?”

The third answer

Infinite power.
Any business logic you need.

Any logic you can write. Any context you can reach.

The third answer

Custom Actions

A programmable action layer for your SWG policies.

Public beta

~0:07 — pure spoken reveal. No board yet — the mechanism gets a proper diagram on the next slide, so don’t draw anything here. Stay at the podium.

A: “One shape. When a policy matches, the request detours through code you control, and the response you hand back is the response the user sees. That’s the whole idea.”

“We’re going to use exactly this shape for two real cases in a minute — someone pasting source code into an AI tool, and someone requesting access they don’t have. Hang onto that.”

B: “Say it back to me in one sentence. Anyone.” — forces retention at the single moment product detail appears.

ONE sentence on the other shape, then move on:
A: “There’s a second shape called Custom Functions that returns a value your policy matches on rather than a response. Different tool, same platform. Grab us in the buffer if that’s your problem.”
Do not expand. Two concepts at 100-level is one too many.

“Is it GA?” → “Targeting Q4.” Full stop.

Transition (A): “Before we look at it live — one thing worth being precise about, because it's the question every security team asks next.”

Architecture appendix

Custom Actions:
powered by Cloudflare Workers.

To the board

~0:09–0:12 — short, precise, no board yet for THIS part. Point at the projected diagram instead of drawing it.

A: “Follow the numbers. One to four is the request, in orange: browser to Gateway, Gateway up to your Worker, the Worker hands its decision back, and only then does Gateway continue to the origin.”

B: “Five to eight, in black, are the response home — and notice your Worker gets asked a second time on the way back, at six and seven. Same detour, same code, both directions. It never gets a direct line to either end.”
Read the colour, not a key: the orange legs 1–4 are the request going out, the black legs 5–8 are the answer coming home. The dark tile is Gateway, because it owns the line; the one object in brand colour is your code. Only the detour is captioned, because it is the only leg that isn’t obvious — captioned once per direction.

If you only point at one thing on this slide, point at the middle dashed box (A): “Notice what’s inside the Cloudflare box. Gateway, and your Worker. Your code isn’t sitting in your network next to your origin, and it isn’t sitting out by the user. It runs here, next to the thing that’s already making the decision.”
The three boxes are the argument; the arrows are just the detail. Left box is the end user, right box is your network, and the tall one in the middle is Cloudflare — and it is tall because it has to hold two things.

This is the answer to the objection that’s coming (A): “Custom Actions doesn’t bypass Gateway and it doesn’t open a new line to your origin. Gateway is still the only thing on that main line — your code just gives it somewhere to check first.”

If someone pushes on latency of the extra hop or what happens if your Worker doesn’t answer: that’s D5 (press 4), not this slide. Don’t improvise failure-mode answers here.

Transition, straight into the board (A): “So what does that actually look like for two real cases? Let’s work through them.”

0:12–0:30 — THE CENTREPIECE. Most of the session lives here. Nothing about the mechanism needs re-drawing — the diagram you just projected already covers it. The board time now is spent applying it to two named cases, not re-explaining how it works.

Scenario 1 — AI / DLP redaction. The easy one.
A: “Someone pastes source code into an AI tool. Your Worker fires, inspects the body, decides, responds. What does it actually need to see to make that call correctly?”

B takes answers. Fish for: the request body / prompt text, maybe a classifier call. Land on: one request in, one response out. No waiting, no state. Say that out loud — this one’s simple — then move to the harder one.

Scenario 2 — business justification, approval, isolation. The one with real teeth.
A: “Someone requests access they don’t have. This time the answer isn’t a straight allow or block — it needs a business reason, and someone has to approve it. Here’s the problem: that approval can take minutes, or two days. Your Worker just fired, synchronously, invoked by Gateway. Can it just… wait?”

B pushes the room to say no, out loud — a Worker cannot hold a request open for a human-speed approval. Then ask: “So what do you do on this request, right now, with an answer you don’t have yet?”

Converge on: ask the user directly for the reason — a form, capturing exactly the “continue, after a reason” idea from the start of the session — kick off the approval out of band, and isolate for now. Not block, not allow.
Then: “And what happens the next time they try?” — a genuinely separate request. The Worker checks again: approved by then, the real decision goes through; still pending, isolate again; denied, block.

The point, out loud (A): “Every invocation is short, and has to decide now, on whatever it can already see. It doesn’t get to wait for the world to change — it only gets to check, and let a future request catch the change.”

B — repeat every question before A answers. Guide requirement, back rows genuinely cannot hear the front.

Wrong answer from the room: never say “no.” Say “That’s close — here’s what bites you.”

Transition, into the demo: “Same shape, one more time — now let’s watch it react to context it couldn’t get from a form.”

Architecture

Custom Actions:
powered by Cloudflare Workers.

To the board

Architecture

Custom Actions:
powered by Cloudflare Workers.

To the board

Custom Actions · Cloudflare Workers

Inspect. Mask. Continue.

import { WorkerEntrypoint } from "cloudflare:workers";

export class GatewayMiddleware extends WorkerEntrypoint {
  async handle(request, context, next) {
    const response = await next(request); // Get upstream response
    const type = response.headers.get("content-type") || "";
    if (!response.body ||
        !/^(text\/plain|application\/json)\b/i.test(type)) {
      return response;
    }

    const body = (await response.text()) // Mask sensitive values
      .replace(/[\w.+-]+@[\w.-]+\.[a-z]{2,}/gi, "[EMAIL]")
      .replace(/\b\d{3}-\d{2}-\d{4}\b/g, "[SSN]");

    const headers = new Headers(response.headers);
    headers.delete("content-length"); // Body size has changed
    return new Response(body, { status: response.status, headers });
  }
}

01 / Inspect

Inspect the HTTP response.

Check the content type and read the body.

02 / Mask

Replace sensitive values.

Your code decides what to mask.

03 / Continue

Return the masked response.

Gateway sends it back to the user.

Before · From the origin

{"email": "alex@example.com"}

After · Returned to the user

{"email": "[EMAIL]"}

Illustrative example · data masking in JSON values

60–90 seconds. “This is the simple masking case from the board, expressed as a Worker. Forward the original request with next, read the upstream response, replace the sensitive values, and return the masked response. The user receives the redacted content.”

The named GatewayMiddleware export extends WorkerEntrypoint, as documented in the internal testing guide updated September 30, 2026. The current handle(request, context, next) contract is POC-era and may change before release. Source: https://wiki.cfdata.org/spaces/GATE/pages/1419376592

This demo uses basic email and US SSN patterns on small, uncompressed text/plain or application/json response bodies; it illustrates custom masking logic, not comprehensive DLP detection. Gateway policy should select the intended destination and endpoint. Production handling should account for payload schemas, encodings, body size, and application-specific validation. Content-Length is removed because the body changes.

Takeaways

Move beyond allow or block to achieve any business logic.

Bring relevant context to your Gateway policy decisions.

Off-mic · 15 more minutes

Bring your ideas to life.

Come chat with us.

Bring the one rule you were told was impossible.

QR code for https://custom-actions-sf-connect.0security.net/

TRY NOW!!!

Leela Kanakala · leela@cloudflare.com

Giriraj Jayaraman · giriraj@cloudflare.com

H10 · ALTERNATE TAKEAWAY · 0 returns

Takeaways

Use the context and business logic your policy needs, not just the controls on a menu.

Move beyond allow or deny with a response designed for the situation.

D3 · LEGACY · 0 returns

The request path · where should your answer be allowed to run?

D4 · LEGACY · 0 returns

The detour

D5 · appendix · 0 returns

Appendix · if it comes up: failure modes

Appendix — not in the main flow. Use this if failure-mode, ownership, or audit questions come up during the board or in the off-mic buffer. Press 4 to jump here, 0 to return to exactly where you left off.

If you end up at a real whiteboard for this, draw three branches: fail open / fail closed / last known good.

Run it as a forced vote if the room is engaged. “Hands. Fail open?” count. “Fail closed?” count. “Neither?” — go to that person first. Write the counts down if you can.

Prompts, best first:
1. “Fail closed means the request dies and the user calls you. Fail open means your control silently stopped existing and nobody called anyone. Which incident do you want?”
2. “Who owns this — your team or the platform team? Be honest about whether they’d let you deploy it.”
3. “An auditor asks which rule was in force last Tuesday at 4pm. Where do you get that answer?”
4. “Should changing this be the same process as a firewall rule, or the same as shipping code? Because those are very different Tuesdays.” — the sharp one.

[PM] B: “Straight with you: this is live for us. Fail-open versus fail-closed, how we surface your code’s logs next to the Gateway log, how you prove your Worker only accepts calls from Gateway — open questions. So I’m not asking rhetorically. What default would you want shipped?”

[SME] B: “The industry hasn’t settled this. Inline anything has had this problem since the first transparent proxy. What did your team decide the last time you put something inline?”

Close, if you use this: “Notice nobody is arguing about JavaScript. You’re arguing about change control, ownership, and blast radius — the same argument you had about your last inline appliance.”

H6 · 0 returns

Recorded demo

B makes this call, not A. Decide within 20 seconds. Never debug on stage.
B’s line: “we’ve got this recorded, let’s not burn your time.”

Narration is identical to the live version: land on the action taken, not the lookup performed.

Setup: save the screen recording as demo.mp4 beside this HTML file. Audio off.

H7 · 0 returns

Shape of the interface

POC-era signature. Confirm against the shipping interface before Connect, or delete this slide.

// Internal POC shape — flagged as likely to change before release.
// Do not put a stale signature in front of a customer.

export default class GatewayMiddleware {
  async handle(request, context, next) {
    // inspect anything on the request
    // return a Response  -> that is what the user gets
    // call next()        -> the request carries on to the upstream
    return next(request);
  }
}

The interesting question was never the signature. It’s what happens when handle throws, hangs, or ships on a Friday.

Interface appendix, buffer only. Slide 8 shows the concise masking example in the main flow.

OPEN ITEM (§10.3): the POC used GatewayMiddleware.handle(request, context, next) and the internal docs explicitly noted that shape was likely to change before release. Get the current signature or drop this slide.

Also unresolved: per-request compute billing. Agree a pricing answer before Connect. Do not speculate on stage.

H11 · alternate · 0 returns

The third answer

Infinite power.
Any business logic you need.

Any logic you can write. Any context you can reach.

2 3	hidden boards — D3 the path · D4 the detour (insurance if the live board fails)
4	D5 — failure modes, appendix only: use if it comes up in Q&A or the buffer, not a scheduled segment
5	H6 — recorded demo (the fallback, B’s call, 20-second rule)
6	H7 — interface shape, buffer only, never in the main flow
7	H9 — detailed request-path architecture, appendix only
8	H10 — fuller takeaway alternate
9	H11 — orange infinity alternate
0	return to the main flow, exactly where you left it
t / r	start-stop / reset the clock — calls time at 15, 30, 40, hard stop 45
s	reveal.js speaker view: notes, next slide, timer
f / esc	fullscreen / slide overview
b / .	black the screen — use this when you turn to the board
? / /	this panel

Creating an infinite extensibility layer to your Secure Web Gateway

Two answers.

Not a bypass.Not a block.

Infinite power.Any business logic you need.

Custom Actions

Custom Actions:powered by Cloudflare Workers.

Custom Actions:powered by Cloudflare Workers.

Custom Actions:powered by Cloudflare Workers.

Inspect. Mask. Continue.

Inspect the HTTP response.

Replace sensitive values.

Return the masked response.

Bring your ideas to life.

Infinite power.Any business logic you need.

Live controls

Not a bypass.
Not a block.

Infinite power.
Any business logic you need.

Custom Actions:
powered by Cloudflare Workers.

Custom Actions:
powered by Cloudflare Workers.

Custom Actions:
powered by Cloudflare Workers.

Infinite power.
Any business logic you need.