Overview
This integration enables organizations to redirect all public GenAI traffic to F5 SurePath AI through Cloudflare Secure Web Gateway policies. A DNS policy resolves the GenAI domains in the SurePath AI public services catalog to the SurePath AI edge, and an HTTP policy attaches two headers to that traffic: an X-Authenticated-User header carrying the identity of the signed-in user, and an X-SP-Connector-ID header identifying the Cloudflare connector. This approach provides complete visibility in both Cloudflare and SurePath AI logging systems, allowing admins to use either platform for troubleshooting or analysis.
Because Cloudflare supplies the user identity on every request, users are not prompted to authenticate when they access GenAI services governed by SurePath AI. The experience is fully transparent, and it matches the way the Netskope and Zscaler integrations attribute traffic.
Organizations implementing this integration should understand that all users whose traffic matches the configured policies will have their public GenAI access redirected to SurePath AI. The policies apply only to devices running the Cloudflare One Client, so unmanaged devices, personal devices, and servers are not covered by this integration. For POC or pilot deployments, admins can add an identity condition to the policies to redirect traffic for a subset of users or groups, then widen the policies to all users for production deployment.
Prerequisites
Verify the Cloudflare environment requirements
This integration depends on three Cloudflare capabilities, and admins should confirm all three before starting the configuration.
The Cloudflare One Client (formerly WARP) must be deployed in Traffic and DNS mode and registered against an identity provider. Cloudflare can only populate the X-Authenticated-User header for devices that have a registered identity, and a device running in DNS-only mode still follows the DNS policy to the SurePath AI edge without ever having the HTTP policy applied to it.
TLS inspection must be enabled for GenAI traffic. HTTP policies can only modify request headers on traffic that Cloudflare proxies and decrypts, because headers are not visible on traffic that passes through encrypted. Before enabling TLS inspection, admins must install the Cloudflare root certificate on all in-scope devices, otherwise every inspected HTTPS session fails with a certificate error. This is a Cloudflare certificate and is separate from the SurePath AI Root CA.
Identity variables must be available in HTTP policy headers. This is a Cloudflare beta feature, described in the section below.
Distribute SurePath AI Root CA to endpoints
SurePath AI recommends that organizations distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority before beginning the Cloudflare configuration. GenAI traffic is decrypted twice in this deployment: once by Cloudflare during TLS inspection, and again by the SurePath AI edge. Distributing the certificate prevents certificate trust errors or warnings in browsers and applications. This certificate is separate from the Cloudflare root certificate described above, and both are required.
To download and distribute the certificate:
In the Admin UI, click Organization in the CONFIGURE section and select the Integration tab
Select the certificate format appropriate for the endpoint operating systems
Click the DOWNLOAD CERTIFICATE button
Distribute the SurePath AI Root CA using existing certificate deployment mechanisms, such as Group Policy, Mobile Device Management (MDM) platforms, or endpoint management tools
Confirm identity variables are available
The X-Authenticated-User header is built from a Cloudflare identity variable, @{identity.email}, which resolves to the email address of the signed-in user at the time the request is proxied. Support for identity variables in HTTP policy headers is a Cloudflare beta feature and is not enabled on every account.
To confirm availability, begin creating an HTTP policy, set the action to Allow, and turn on Modify request headers. If the header value field accepts @{identity.email} and offers a variable picker next to the field, the feature is available. Discard the policy without saving it once the check is complete. If the feature is not available, admins should contact their Cloudflare account representative to have it enabled before continuing with this integration.
Check the Terraform module version
Organizations that manage their Cloudflare configuration with Terraform rather than the dashboard must use Cloudflare module version 5.23.0 or later. Earlier versions cannot express the policy configuration described in this article. The steps below describe the dashboard workflow, and admins working in Terraform should translate them into their own configuration.
Download the Cloudflare public services catalog
SurePath AI maintains and curates a list of GenAI sites across the public internet, including vendor names and associated risk levels. This list is downloaded in Cloudflare-compatible format and used as the traffic condition in both policies.
In the Admin UI, click Public Services in the GOVERN section
At the top right of the page, click the DOWNLOAD CATALOG button
In the Download Format drop-down, choose Cloudflare Config
Click DOWNLOAD
The downloaded file will be named similar to surepath-ai-public-services-cloudflare-YYYY-MM-DD.txt, and its contents are pasted into the value field of both policies. Admins should not add additional domains to this file. If there are sites that need to be added to the catalog, the admin should contact their SurePath AI technical representative for guidance on the appropriate approach.
The policies do not update themselves when the catalog changes. To receive traffic for newly added GenAI services, admins must download a fresh copy of the catalog and update the value field in each policy.
Create the Cloudflare connector
The connector tells SurePath AI that inbound traffic is arriving from a trusted Cloudflare deployment, and it is what allows SurePath AI to accept the X-Authenticated-User header. For general information about Network Ingress Connector types and configuration, see Network Ingress Connectors.
In the Admin UI, click Connectors in the CONFIGURE section
At the top right of the page, click the ADD CONNECTOR button
In the Name field, enter a name such as Cloudflare Connector
In the Type drop-down, from the Network Ingress section, select Cloudflare
Turn on Enable X-Authenticated-User Header
Click SAVE
Note the Connector ID value — it is required for the HTTP policy
Understanding X-Authenticated-User (XAU) header
The X-Authenticated-User header is the component of this integration that identifies the end user to SurePath AI without an authentication prompt.
How XAU works with SurePath AI
When Cloudflare proxies a request to the SurePath AI edge, the HTTP policy inserts the X-Authenticated-User header containing the email address of the signed-in user, and the X-SP-Connector-ID header containing the connector identifier. SurePath AI validates that the traffic is arriving from the trusted Cloudflare connector, then associates the user's identity with their GenAI activity. Users are not redirected to an SSO page and see no interruption.
Both headers are required. Without the connector header, SurePath AI cannot establish that the traffic came from a trusted source and will not honor the identity supplied in the X-Authenticated-User header. Without the identity header, activity cannot be attributed to individual users, and organizations using SurePath AI Discovery mode lose the only method available for identifying who is accessing GenAI services.
Why the headers are overwritten rather than added
The HTTP policy uses Overwrite headers rather than Add headers. Overwriting replaces any value already present on the request, so a header set locally by a browser extension, a modified client, or a user attempting to impersonate someone else is discarded and replaced with the value Cloudflare derives from the authenticated session. Adding headers would leave a client-supplied value in place alongside the Cloudflare value, which would allow a bad actor to influence how SurePath AI attributes their activity. Admins should not use Add headers for either header.
Cloudflare configuration steps
The Cloudflare configuration involves two required Secure Web Gateway policies and one optional policy. The DNS policy steers GenAI traffic to the SurePath AI edge. The HTTP policy attaches the identity and connector headers to that traffic. The optional bypass policy limits TLS inspection to GenAI traffic for organizations that do not inspect broadly.
All of the following steps begin from the Cloudflare One dashboard. Click Traffic policies in the left navigation and select Firewall policies before starting each policy below.
Create the DNS policy
Click Add a policy
In the If traffic type is... drop-down, select DNS
Enter a policy name such as SurePath AI - GenAI DNS policy
Optionally, enter a description such as DNS policy that directs GenAI traffic to SurePath AI
Under And traffic matches..., add a condition
In the selector drop-down, select Host
In the operator drop-down, select matches regex
In the value field, enter the contents of the Cloudflare Config file downloaded in the prerequisite step above
Under And identity matches...:
With no condition specified, this configuration applies to all users
To restrict the configuration to specific users or groups during a pilot, add a condition
In the Then... drop-down, select Override
In the Override destination field, enter
edge.surepath.ai. The value is added to the field as a tag.
Click Save
Create the HTTP policy
Click Add a policy
In the If traffic type is... drop-down, select HTTP
Enter a policy name such as SurePath AI - GenAI HTTP policy
Optionally, enter a description such as HTTP policy that adds SurePath AI identity and connector headers to all GenAI traffic
Under And traffic matches..., add a condition
In the selector drop-down, select Host
In the operator drop-down, select matches regex
In the value field, enter the contents of the Cloudflare Config file downloaded in the prerequisite step above
Under And identity matches...:
With no condition specified, this configuration applies to all users
To restrict the configuration to specific users or groups during a pilot, add a condition
Under And posture matches...:
With no condition specified, this configuration applies to all devices regardless of posture
To restrict to a specific device posture, add a condition
In the Then... drop-down, select Allow
In the Untrusted certificate action drop-down, select Pass through. Cloudflare then connects to the SurePath AI edge without verifying its certificate. This setting applies only to hosts matched by this policy.
Turn on Modify request headers
Click Overwrite headers and add the identity header
In the Header name field, enter
X-Authenticated-UserIn the Header value field, enter
@{identity.email}
Click Overwrite headers again and add the connector header
In the Header name field, enter
X-SP-Connector-IDIn the Header value field, enter the Connector ID value from the prerequisite step above
Click Save
The identity and posture conditions on this policy must be at least as broad as the identity condition on the DNS policy. If the DNS policy sends a user's traffic to the SurePath AI edge but this policy does not apply to that user, their requests arrive at SurePath AI with neither header, so SurePath AI cannot establish that the traffic came from a trusted source.
Create the bypass policy (optional)
This policy is only needed for organizations that do not already perform broad TLS inspection and want to limit Cloudflare's inspection scope to GenAI traffic only. If TLS inspection is already applied broadly across all traffic, this policy is not required. When configured, it prevents Cloudflare from performing TLS inspection on non-GenAI traffic, which also means Cloudflare no longer logs or blocks HTTP requests, applies DLP policies, or performs antivirus scanning on that traffic.
Click Add a policy
In the If traffic type is... drop-down, select HTTP
Enter a policy name such as SurePath AI - non-GenAI bypass
Optionally, enter a description such as Bypasses TLS inspection for all non-GenAI traffic
Under And traffic matches..., add a condition
In the selector drop-down, select Host
In the operator drop-down, select does not match regex
In the value field, enter the contents of the Cloudflare Config file downloaded in the prerequisite step above
In the Then... drop-down, select Do Not Inspect
Click Save
Because this policy matches only hosts that are absent from the catalog, it cannot match GenAI traffic, and its position in the policy list does not affect the SurePath AI HTTP policy. Any other Do Not Inspect policy in the account is a different matter. Cloudflare evaluates all Do Not Inspect policies ahead of Allow policies regardless of their position in the list, so a pre-existing Do Not Inspect policy that matches a GenAI domain suppresses the SurePath AI HTTP policy and its headers. Admins should review the account for existing Do Not Inspect policies that overlap the catalog.
Verification and troubleshooting
To verify the configuration, follow the steps in the Verifying the SurePath AI integration article.
After the policies are deployed to test users or groups, admins should also confirm in the Admin UI that activity is attributed to named users. Click User Activity in the OBSERVE section and review recent GenAI requests from the test population. Two failure patterns are worth separating.
If requests reach SurePath AI but are not attributed to a named user, the HTTP policy is applying and the connector header is arriving, but the identity variable is not resolving. The usual cause is a device that is not registered against the identity provider.
If requests reach SurePath AI with no headers at all, the HTTP policy is not applying to that traffic. The usual causes are a device running the Cloudflare One Client in DNS-only mode, an identity or posture condition on the HTTP policy that is narrower than the identity condition on the DNS policy, or a pre-existing Do Not Inspect policy in the account that matches the GenAI domains.
Organizations intercepting developer tools should also review Intercept support for developer tools, which documents a Cloudflare-specific requirement for Cursor to operate in HTTP/1.1 compatibility mode.