Building a Read‑Only Cloudflare Worker AI Security Console

Описание и применение

Создано безопасное, только для чтения, AI‑поддерживаемое консольное приложение на Cloudflare Workers, которое агрегирует данные аналитики, предоставляет естественные запросы, дайджесты и расследования Ray‑ID, при этом ограничивая права AI и обеспечивая контроль доступа.

Задача

Security teams have data but lack a fast, readable operational view that keeps AI from gaining unsafe authority.

Результат

The console delivers a read‑only, AI‑augmented security dashboard that lets analysts query data in natural language, view curated queries, receive daily digests, and investigate Ray IDs—all while preventing the AI from modifying Cloudflare resources.

Рабочий процесс

• Create a read‑only Analytics API token with minimal permissions
• Bootstrap a Cloudflare Worker named sentinel‑cf
• Protect the Worker with Cloudflare Access (policy, MFA, short session)
• Add a Workers AI binding named AI
• Create and bind a KV namespace for latest digests
• Configure an AI Gateway for observability and rate limiting
• Add runtime variables and secrets (CF_ANALYTICS_TOKEN, APP_HOSTNAME, AI_GATEWAY_ID, ALLOWED_ZONE_TAGS, ENVIRONMENT, DEFAULT_DIGEST_RANGE, DIGEST_TITLE)
• Deploy the Worker code (sentinel‑cf‑worker.js)
• Test each endpoint (/, /query, /allowed‑queries, /digest, /ray, /healthz)
• Codify the configuration with Terraform for production
• Schedule daily digests via Cron Trigger and store in KV

Доказательства

The model should not be the administrator.

Источник

Workers AI owns: Intent classification when deterministic matching is not enough.

Источник

The right production pattern is: AI recommends, humans approve, Terraform or approved change control applies.

Источник