Writing
Notes from running a fleet.
Real answers to real questions — the error messages, the firewall log, and the decisions behind the product.
-
Why we let an AI propose changes to production but never make them
Not a policy, not a system prompt, not a confirmation dialog. The model in Zonesteward has no write tool to be talked out of, and here is why that's the only design that survives contact with attackers.
-
Reading Cloudflare firewall events: who is actually attacking you
Most of what the firewall log shows you isn't an attack. How to tell a credential scanner from a theme loading its own CSS, and why getting the 'not an attack' half right matters more.
-
What Cloudflare's "Invalid zone access" error actually means, and how to fix it
It isn't your token. Well, it is — but not the way the message implies. What the GraphQL API is really telling you, why it fails your whole query, and how to work around it.