Cloudflare added a natural-language helper that drafts WAF rule expressions you must review before deploy.
Cloudflare will turn a sentence like “block empty user agents on /api” into a draft WAF expression. You still hit deploy. That is the correct amount of trust for something that can lock out customers.
Where it helps
Newcomers get past blank-page syndrome. Experts get a first pass they can tighten. Neither group should skip reading the expression. Natural language is a shortcut to syntax, not a substitute for knowing what you blocked.
Cloudflare says confirmation remains mandatory. There is no silent auto-publish in the description of the feature. Keep it that way in your own process even if a future UI tempts you.
Safe workflow
Generate on a staging hostname. Run synthetic checks for good traffic and the bad pattern you care about. Promote only when both look right. Log who accepted the rule.
Security automation fails when people stop reading. Cloudflare made drafting faster. Reading stays the job.
Pairing rule
Require a second person to read any natural-language-generated rule that touches authentication, checkout, or API write paths. Solo deploys of AI-drafted WAF logic are how you block an entire geography by accident. Keep a changelog of prompt text plus final expression. When something breaks, you want both. Cloudflare accelerated drafting. Two-person review keeps production boring.
Prompt library for WAF
Store approved natural-language prompts that produced good rules—“challenge ASNs with high 404 rates on /wp-login” is better than “stop bots.” Version them. When Cloudflare’s generator improves, re-run old prompts and diff expressions. Treat prompts as code-adjacent artifacts. The company made English a valid draft input; your team should manage that input with the same seriousness as Terraform. Add staging hostnames to every draft review checklist, and refuse to promote a rule that nobody can explain in one spoken sentence. If two reviewers disagree, keep the stricter expression until traffic data settles the argument.