Available
Envoy routing
Strict timeouts, connection limits, health checks and last-known-good configuration.
Fast data plane
Global entry. Local decisions. Parallel analysis.
Cloudflare for SaaS supplies global ingress and volumetric protection. Envoy and Coraza apply service-specific controls without a central database or AI call in the request path.
01
What this capability is responsible for
Each function has a narrow operating boundary and a state derived from evidence.
In observation
Coraza inspection
OWASP CRS runs out of process over a private Unix socket and remains shadow-first.
Available
Asynchronous intelligence
Bounded metadata enters the case and threat pipelines without delaying the visitor.
02
How the operating flow works
The visitor path remains short while control, evidence and rollback stay explicit.
- 01
Cache first
Cloudflare serves eligible static assets before they reach AegiFlow.
- 02
Inspect locally
Envoy and Coraza make bounded request decisions on the edge host.
- 03
Analyze later
The control plane correlates events and proposes reversible action.
Start with observation. Promote only measured controls.
Every traffic activation requires ownership, certificate, origin and rollback checks.