cloudflare-one

Guides Cloudflare One Zero Trust and SASE work across the full product surface - Access, Gateway, WARP, Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use it when designing, configuring, troubleshooting, or reviewing Cloudflare One deployments. It is deliberately retrieval-first: before citing limits, settings, API fields, category IDs, or exact UI paths, it directs you to retrieve current information from the Cloudflare One documentation, the Cloudflare docs MCP server, or the Cloudflare API schema rather than relying on embedded product details that may drift.

Its workflow is to classify the ask (architecture, configuration, troubleshooting, migration, or review), gather context such as account ID, users, sites, apps, identity provider, SCIM and group sync, device management, traffic path, compliance constraints, and rollout blast radius, retrieve only the current docs for the products involved, inspect existing resources before proposing or making changes when account access is available, and propose a change set with prerequisites, validation, and rollback. For risky changes it recommends staging disabled or scoping to a pilot group or site unless the user asks otherwise. A large set of assessment prompts helps avoid jumping straight to configuration, grouped by area: architecture and current state, Access and SaaS federation, Tunnel and private networking, Gateway/TLS/DLP, CASB/device posture/risk, and Cloudflare WAN site connectivity - each with links to retrieve the relevant docs.

Guardrails capture the product distinctions that matter in design. Access controls application authorization while Gateway controls traffic inspection and filtering, and both are used when a requirement spans identity-aware app access and network or web security. Public hostname Access apps can be clientless, whereas private destination apps require the WARP/Device client or another on-ramp plus routes and DNS resolution. Cloudflare Tunnel is an off-ramp from a private network to Cloudflare, while Cloudflare WAN and Mesh can serve as both off-ramps and on-ramps. Group-based policies depend on IdP group claims or SCIM, and the skill is explicit that if group sync is missing you should not invent group selectors, and that private hostnames need explicit DNS routing and resolution.