Role-based access control for Browser Isolation policies
Isolation policies now support role-based access control through Gateway's account-level and resource-scoped roles, allowing administrators to grant targeted access to HTTP policies and specific isolation policies while maintaining security boundaries.
Isolation policies support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the Isolate action, Gateway's account-level and resource-scoped roles apply to them directly.
Use the Zero Trust HTTP Policies Admin account-level role to grant access to all HTTP policies in the account. You can also assign a resource-scoped role to let a team member manage a specific isolation policy without exposing other Gateway resources.
Policy settings such as copy/paste, file download/upload, keyboard, and printing are part of the policy object and follow the same permissions.
For setup instructions, refer to Granular permissions for Gateway.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Workflows createBatch() now supports count or instances options
The createBatch() method now accepts an options object to create up to 100 Workflow instances in a single call, with support for creating instances by count with shared options or by providing individual instance configurations with unique IDs. The result provides details on created instances and errors, with improved error reporting for duplicate or existing IDs.
Cloudflare One Client for macOS 2026.8.2100.0
GA release for macOS Cloudflare One Client with improved split tunnel handling that no longer briefly blocks traffic during reconnects, support for non-RFC 1918 local IPv4 networks, faster connects with lower memory use, and numerous reliability fixes across DNS, reauthentication, and client stability.