Cloudflare WAF Rule Map from Zone Inventory (No Invented Block Rates)

Prompt

Act as a Cloudflare WAF rule cartographer who only uses a pasted zone inventory. You write a WAF rule map the inventory already supports. You do not invent block rates, challenge scores, API tokens, or custom expression strings not in Inputs. This is not a penetration test report and not a Cloudflare billing estimate.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Cloudflare zone inventory I lock (rule stubs, expression cues, action notes): [Inventory]
- Cloudflare / WAF version notes I lock: [Version]
- Zone or account label I may quote (or UNKNOWN): [Workspace]
- Required rule names I may quote (or UNKNOWN): [SpecNames]
- Rule titles already present (or UNKNOWN): [RuleTitles]
- Expression cues already present (or UNKNOWN): [ExprCues]
- Action and skip notes already present (or UNKNOWN): [ActionNotes]
- Words I must not use: [Banned]
- What I must never invent (block rates, challenge scores, API tokens, fake expressions): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, RuleTitles, ExprCues, ActionNotes, Lang. Forbidden: invented block rates, challenge scores, API tokens, fake expressions. Banner: not a penetration test report; not a Cloudflare billing estimate.
2. WAF rule map table: one row per Inventory rule stub or expression cue. Missing ActionNotes write NOT IN INPUTS. Use Cloudflare WAF custom rules, managed rules, actions, and skips language when Inventory supports it. Never print block-rate or challenge-score VALUES not in Inventory.
3. Spec name set: only names in SpecNames. Unnamed rules stay NOT IN INPUTS. Never invent API-token VALUES not in Inventory.
4. Version lock: print Version. Refuse Cloudflare WAF features newer than Version if Version is named.
5. Refuse list: inventing block rates, inventing challenge scores, inventing API tokens, inventing expression strings not in ExprCues.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Map from Inventory only. No invented block-rate VALUES. Teach Cloudflare WAF rule mapping, not a generic AWS WAF or Fastly swap.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Cloudflare WAF Rule Map from Zone Inventory (No Invented Block Rates) - Result

Examples

Example Input

Inventory: rule Harbor Quay Block Bad Bots as pasted expression cue http.user_agent contains scrapy as pasted action notes block as pasted; rule River Ops Skip Healthchecks as pasted expression cue http.request.uri.path eq /health as pasted. Block rate invent NONE. Score invent NONE.
Version: Cloudflare WAF custom rules 2024 as pasted (do not invent unreleased AI rule writer)
Workspace: Harbor Quay edge zone as pasted
SpecNames: Block Bad Bots as pasted; Skip Healthchecks as pasted. APIToken UNKNOWN.
RuleTitles: Block Bad Bots as pasted; Skip Healthchecks as pasted. Rate Limit API UNKNOWN.
ExprCues: http.user_agent contains scrapy as pasted; http.request.uri.path eq /health as pasted. cf.threat_score UNKNOWN.
ActionNotes: block as pasted. managed challenge NOT IN INPUTS.
Banned: guaranteed block, rate invent, score invent, token invent
Never: invent block rates, invent challenge scores, invent API tokens, invent fake expressions
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: rule Harbor Quay Block Bad Bots expression cue http.user_agent contains scrapy action notes block; rule River Ops Skip Healthchecks expression cue http.request.uri.path eq /health. Block rate invent NONE. Score invent NONE. Version Cloudflare WAF custom rules 2024. Workspace Harbor Quay edge zone. SpecNames Block Bad Bots; Skip Healthchecks; APIToken UNKNOWN. RuleTitles Block Bad Bots; Skip Healthchecks; Rate Limit API UNKNOWN. ExprCues http.user_agent contains scrapy; http.request.uri.path eq /health; cf.threat_score UNKNOWN. ActionNotes block; managed challenge NOT IN INPUTS. Lang English. Banner: not a penetration test report; not a Cloudflare billing estimate. Forbidden: invented block rates, challenge scores, API tokens, fake expressions, guaranteed block, rate invent, score invent, token invent.

3. Spec name set. Block Bad Bots; Skip Healthchecks as SpecNames. APIToken UNKNOWN so write APIToken NOT IN INPUTS. No block-rate VALUES beyond Inventory. No third rule invented.

4. Version lock. Cloudflare WAF custom rules 2024 as pasted. Unreleased AI rule writer not used. Managed packs NOT IN INPUTS.

5. Refuse. Rate invent: refused. Score invent: refused. Token invent: refused. Expression invent: refused. Guaranteed block: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: APIToken decision, Rate Limit API RuleTitles, cf.threat_score ExprCues, managed challenge ActionNotes, managed packs list if any.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.