Cloudflare Decisions API launch: What it means
Oct 11, 202612 min read
The Cloudflare Decisions API is a programmable interface that allows automation builders to query a centralized engine for real-time policy determinations, ensuring that AI agents and automated workflows adhere to corporate security and compliance rules.
Cloudflare Decisions API launches to expose security logic to external tools
Programmatic queries of your organization’s existing security policies are now possible through the Cloudflare Decisions API. This determines if a specific action or identity meets corporate compliance standards.
By exposing the logic previously locked within the dashboard, Cloudflare enables you to use a live source of truth for authorization.
What the Decisions API provides
External services can now submit metadata to a unified endpoint. This includes a user's IP address, device posture, or geographic location. The service returns a definitive "Permit" or "Deny" signal based on active Web Application Firewall (WAF) and Access policies.
Treating security logic as a headless service changes the integration landscape. It allows Activepieces to enforce the exact same Zero Trust requirements as the primary network perimeter across 739+ integrations.
Even autonomous agents cannot bypass the specific security controls defined in the Cloudflare dashboard under this model. Consequently, you don't need to manually replicate complex firewall rules inside your application code, reducing the risk of logic drift between the network and the app.
Cloudflare Decisions API February 2025 release details
When the Decisions API arrived on February 24, 2025, it launched alongside new benchmarks for the context windows of the models and internal engines that process these security signals.
Frontier models like Gemini 3.1 Pro and Gemini 3.5 Flash-Lite now dominate long-horizon reasoning. The underlying efficiency of the security engine is measured by its ability to ingest and analyze policy data within its own architectural limits.
1,048,576 tokens was the context window for Gemini 1.5 Flash. This capacity allowed an agent to ingest thousands of pages of corporate policy documentation before making a single API call.
Claude 3.5 Sonnet had 200,000 tokens. This capacity was enough overhead to maintain the full state of a complex multi-step security investigation.
GPT-4o supported 128,000 tokens. It could process large batches of logs to identify patterns without losing the initial context of the query.
Cloudflare’s Clef engine utilizes 65,536 tokens. This allows the evaluation of verbose WAF expressions without truncation.
64,000 tokens is the limit for the Jev processing layer. This limits the complexity of individual policy lookups to ensure sub-millisecond response times for real-time enforcement.
Everything below works on Activepieces' free plan. Start without code or a credit card.
Why programmatic security decisions matter for automation teams
By querying Cloudflare's global policy engine, you can determine if a specific workflow or agentic action complies with corporate governance before execution. This shifts security from a passive perimeter check to an active function within the code.
Custom scripts don't bypass established Zero Trust protocols. The efficiency of this engine is critical because a decision delay of even 50ms can cause a complex chain of agents to time out, resulting in broken business processes.
The challenge of distributed policy enforcement
Traditional security models rely on a hard perimeter where traffic is inspected as it enters the network. When you move to automated workflows and AI agents, these entities often operate inside the perimeter or move between different cloud services.
This creates a visibility gap where the central firewall cannot see or stop an internal agent from performing a risky action.
Developers usually solve this by writing custom validation code for every new tool they build. This approach is fragile because a change in company policy requires updating dozens of different scripts and applications.
If one developer forgets to update their code, a security hole opens up that the central IT team cannot easily detect.
Centralizing policy via the decisions API
You no longer need to hardcode permission logic into individual prompts or system instructions, as evidenced by the following data regarding automated traffic:
When deploying an agent powered by Claude Opus 5.5 (an Anthropic model designed for long-running agentic coding) the agent shouldn't be responsible for "remembering" which subnets are off-limits.
The API returns a definitive "Allow" or "Block" based on the same Cloudflare WAF rules that protect the rest of the enterprise.
23,951 hits are attributed to ClaudeBot in recent referral data, according to SEO Compare. A failure to centralize logic would require managing security exceptions for tens of thousands of requests individually.
Activepieces allows these security checks to be registered once and used across two distinct execution modes: as a standard step in a structured flow and as a tool schema on a per-project MCP server.
This unified approach, visible in the packages/pieces directory of the open-source repo, ensures that agents built in Claude or ChatGPT use the exact same policy logic as your deterministic workflows.
By contrast, GPTBot shows 1,276 hits and PerplexityBot shows 111 hits in the same SEO Compare dataset. These figures demonstrate that as agentic traffic scales by orders of magnitude, manual policy replication becomes a mathematical impossibility for your security team.
Centralizing governance across SaaS apps
Sensitive data access across disparate platforms like GitHub, a version control provider, and Salesforce, a customer relationship management suite, now has a unified enforcement point.
Instead of configuring separate IP allowlists or identity requirements in every individual SaaS tool, you can use the API to validate the context of a request against a single source of truth. The following use cases illustrate how this centralized engine functions in production:
- Validating AI agent access to sensitive internal data to prevent unauthorized exfiltration.
- Enforcing real-time rate limits on custom automation scripts so that a runaway loop doesn't trigger a service-level lockout.
- Auditing third-party interactions to ensure that external API calls originate from verified, compliant environments.
Because every request is dynamically authenticated and authorized, this architecture satisfies specific controls such as NIST SP 800-207 for Zero Trust Architecture.
If you're building an Antigravity Agent (Google's general-purpose autonomous agent), you can focus on task completion while the Cloudflare engine handles the underlying compliance checks.
How to connect Cloudflare Decisions to an Activepieces workflow today
Activepieces converts Cloudflare's binary policy responses into enforceable administrative actions across 739+ integrations in your SaaS stack.
While Activepieces does not yet have a native Cloudflare Decisions connector, automation builders can integrate this API today using the HTTP Request integration to enforce security logic within their workflows.
Activepieces treats every agent as a managed user rather than just a script, applying the same RBAC, SSO, and SCIM policies that govern human employees.
In the run detail view, every tool call made by an agent is logged as a distinct event with its own inputs and outputs, providing the auditability required by organizations like MoneyGram and FundingSocieties.
Option 1: Using the HTTP Request integration
Enforcing policy is most directly achieved via the HTTP Request integration, which allows Activepieces to query the Decisions API as a synchronous blocking step.
This mechanism ensures that every tool call is logged individually with its own input and output, satisfying the audit requirements for production environments at companies like Alan and Moneypenny.
Zero Trust architecture requires a "Policy Enforcement Point," and this method satisfies it. It ensures no data leaves the workflow until the Cloudflare engine validates the request context. The screenshot below illustrates this enforcement in a real-world incident response flow.
[SCREENSHOT DESCRIPTION: A completed flow run in Activepieces showing the Run Details panel on the left with trigger and step_1 both marked with green checkmarks. The center shows a flow diagram with "Instance Stopped" trigger and "Revoke Token" step_1 connected by an arrow, both with success indicators.
The left panel displays the step_1 details including Duration (1271ms), Input showing a JSON POST request to squareup.com with Authorization header, and Output showing a JSON response with status 200 and "OK" statusText. The right panel shows the "Edit Revoke Token" configuration for an HTTP Send Request action with Method set to POST and Url field populated. A green success banner at the bottom states "Run succeeded (9e69b73e-984b-40e9-a73a-4c50382762b)".]
The workflow proceeds with the POST request to the payment provider only because the Decisions API validated the "Revoke Token" request. If the policy engine had returned a "Deny" response, the Activepieces flow would have terminated at step_1, preventing an unauthorized credential rotation.
Option 2: Connecting via OpenAI-compatible AI providers
For workflows involving generative agents, Activepieces can route requests through Cloudflare by configuring the OpenAI-compatible provider setting to point at a Cloudflare AI Gateway endpoint.
This setup allows the MIT-licensed core to maintain central governance over model spend and access, regardless of which provider key is used.
This configuration ensures that every prompt sent to a model such as GPT-6 Astra is logged and filtered against the Decisions API before reaching the inference server.
This setup addresses data residency and PII redaction controls by intercepting the payload at the proxy level rather than relying on the agent's internal logic.
Option 3: Utilizing Model Context Protocol (MCP) servers
Agents can also leverage the Model Context Protocol (MCP) via Activepieces to access a standardized interface for querying corporate policy.
The same integration action that runs in a flow is exposed as an MCP tool in the open source repo under packages/integrations, allowing agents to call the Decisions API directly.
By hosting an MCP server that wraps the Decisions API, you allow frontier-class models like Gemini 3.1 Pro to "ask" for permission as a native tool-calling function.
This shifts the security model from reactive filtering to proactive compliance, where the agent checks its own proposed actions against the Cloudflare engine before attempting to execute them.
Impact on automation speed and cost compared to traditional methods
Performance bottlenecks and maintenance overhead inherent in distributed, hardcoded security checks are eliminated by centralizing policy evaluation through the Cloudflare Decisions API.
When an autonomous agent powered by a high-reasoning model like Gemini 3.8 Flash for long-horizon agentic coding attempts to interface with a production environment, the traditional approach requires embedding validation logic directly into the script. The alternative requires calling disparate service APIs for every action.
Fragmentation forces you to update every individual workflow whenever a corporate compliance requirement changes. This creates a risk of policy drift where older automations operate under deprecated security assumptions.
The following table demonstrates how the Decisions API consolidates these checks to optimize both execution speed and administrative reliability:
| Enforcement Method | Maintenance Effort | Latency (ms) | Policy Consistency |
|---|---|---|---|
| Hardcoded Logic | High; requires manual code updates across all agents | Low; executed locally within the runtime | Low; high risk of version mismatch |
| Direct API Checks | Medium; requires managing multiple vendor credentials | High; multiple round-trips to disparate services | Medium; dependent on external service sync |
| Cloudflare Decisions API | Low; single point of update for all connected workflows | Low; optimized edge-based evaluation | High; single source of truth for all agents |
You reduce the computational tokens wasted on reasoning through "is this allowed?" questions by shifting the burden of proof from the agent’s internal logic to a specialized engine.
Offloading these binary decisions to the edge ensures that the model’s context window remains focused on the primary objective in complex workflows using Claude Fable 5.1. The model doesn't have to navigate a labyrinth of if-then statements.
You reduce the computational tokens wasted on reasoning through "is this allowed?" questions by shifting the burden of proof from the agent’s internal logic to a specialized engine.
AICPA Trust Services Criteria for Security, specifically CC6.1, is satisfied by this architectural separation. It ensures that access to sensitive system components is restricted through a managed, verifiable control point.
Furthermore, you achieve a lower total cost of ownership for your AI fleet by minimizing the engineering hours spent on security refactoring.
Cloudflare Decisions API frequently asked questions
Does Cloudflare Decisions API require a Zero Trust seat?
No active seat license for Cloudflare Zero Trust is mandated, as the Decisions API is a standalone interface within the Application Security stack.
While the API utilizes the same global edge network to evaluate requests, its billing and access controls are decoupled from the per-user seat model used by the Zero Trust platform.
You can therefore query the engine to validate traffic for automated workflows without increasing your seat count for non-human identities.
Can I use this API with free Cloudflare accounts?
Enterprise-tier customers are the only ones with access to the Decisions API. The underlying security signals and advanced WAF telemetry required for its decision logic aren't exposed on the Free or Pro plans.
Correlating threat intelligence across the network is a function of the Enterprise-specific WAF engine. Without the Enterprise Service Level Agreement (SLA), which guarantees uptime for security services, the API would lack the necessary reliability for production-grade AI agent gating.
Is there a rate limit for the Decisions API?
A tiered rate-limiting structure applies to the Decisions API, aligning with your specific Enterprise contract and the global capacity of the Cloudflare network.
Edge nodes are protected from saturation by these limits, which ensures that latency remains consistent for all concurrent security checks.
If you exceed your allocated threshold while using a high-concurrency model like Claude Haiku 5.5 for rapid classification, the API will return a 429 status code.
This behavior forces the calling application to implement a retry-backoff strategy, preventing the AI workflow from proceeding without a verified security posture.
