Configure policies

Use workloads to select requests and policies to check them. Group policies in a policy set, then attach that set to a deployment.

You need access to manage Cloud Workload Security in your account. Before attaching a policy set, create a deployment. To connect a proxy, follow Get started.

Create a workload

A workload is a reusable request filter. For example, you can group requests to the Cloudflare API.

Use separate workloads to target security profiles for production and non-production environments. Include each workload in the policy set for that environment.

In the Cloudflare dashboard, select your account and go to Cloud Workload Security > Workloads.
Go to Workloads ↗
Select Add workload and enter a Workload name.
In Filters, select Wirefilter and enter a filter. This example matches Cloudflare API requests:
```
application.name == "Cloudflare"
```
You can also use Visual Builder to select fields, operators, and values. Select an application before selecting its service or operation.
Select Add workload to save the workload.

Create a policy

Both Filters and Rego source are required.

A policy filter selects the requests that run its Rego check. The Rego source must declare a package under policy. and a Boolean rule named valid.

In the Cloudflare dashboard, go to Cloud Workload Security > Policies.
Go to Policies ↗
Select Add policy and enter a Policy name.
In Filters, select Wirefilter and enter the request scope. This example selects R2 API requests:
```
application.name == "Cloudflare" and application.service == "r2"
```
In Rego source, enter the check. This example permits only GET requests within the selected scope:
Rego sourcetxt
```
package policy.r2_read_only

default valid := false

valid if {
  input.http.request.method == "GET"
}
```
Use input.http.request.body to inspect parsed request content. For a request-body example, refer to the R2 public-access guardrail.
Select Add policy to save the policy. Correct any filter or Rego errors before continuing.

Create a policy set

A policy set groups policies and their workload scope. A request must match an included workload and must not match an excluded workload. Without included workloads, the set has no inclusion restriction.

In the Cloudflare dashboard, go to Cloud Workload Security > Policy sets.
Go to Policy sets ↗
Select Add policy set and enter a Policy set name.
In Workloads, select Attach workload, choose the workloads to include, and confirm the selection. To omit a group of requests, select Exclude workload.
In Policies, select Attach policy, choose the policies, and select Attach policies.
For each policy, turn on Enforce to block requests that fail its check. Turn it off to evaluate the policy without blocking on its result.
Select Add policy set to save the set.

The policy filter still applies within the policy set's workload scope. A workload match does not bypass a policy filter.

Attach the set to a deployment

In the Cloudflare dashboard, go to Cloud Workload Security > Deployments and open the deployment.
Go to Deployments ↗
In Policy sets, select Attach policy set, choose the set, and select Attach policy sets.
In Deployment settings, choose a Default mode. Default allow permits requests outside every policy's request scope. Default block blocks those requests.
Select Save. Allow a configuration refresh interval before testing through the proxy.

Default mode and enforcement

A policy matches when its policy set's workload scope and its filter both match. The deployment default mode applies when no policy matches. A false Rego result is a failed check, not an unmatched request.

For example, a matching policy with Enforce off does not block a false result, even with Default block. Another enforcing policy can still block the request.

Send one request that passes your policy and one that fails it. Confirm the failing request returns a CWS block response when Enforce is on.

To change an existing resource, open it from its list and select Save after editing. Changes to a policy or policy set affect deployments that reference it.