From bd6a1e18391e9f9b3621a3e7e8020a96731fad1d Mon Sep 17 00:00:00 2001 From: Kylie Czajkowski Date: Wed, 23 Sep 2026 16:50:40 -0700 Subject: [PATCH 1/2] [Agent Lee] Refresh overview and complete the Cloudflare Agent rename Audit of the Agent Lee docs against the implementation (cloudflare-agent @ 7966d6f3). The overview had drifted since the beta page was written, and the rename from "Cloudflare Agent" left the old name on user-facing surfaces. Naming: - Rename ai/related-products/cloudflare-agent.mdx to agent-lee.mdx and retitle it. It still read "Cloudflare Agent" and pointed at /cloudflare-agent/, taking readers through a 301 to reach the page. - Point the RelatedProduct cards in ai/index.mdx and ai/related-products/index.mdx at /agent-lee/ with product="agent-lee". src/icons/agent-lee.svg was added by the rename but never wired up, so both cards were still resolving the old icon name. - Delete src/icons/cloudflare-agent.svg, byte-identical to agent-lee.svg and now unreferenced. - Drop the stray products: browser-run from the related-products entry; every sibling lists ai alone. - Note the former name on the overview so searches for "Cloudflare Agent" still land. The /cloudflare-agent/ 301 already covers the old URL and that path never had sub-routes, so no new redirect is needed. Redirect fix: - /workers/ai/ pointed at /agent-lee/, sending the legacy Workers AI URL to the dashboard assistant. It entered as /workers/ai/ -> /cloudflare-agent/ in 377142dbda ("[Chore] tech cleanup", #29194) with no stated rationale, and the rename only retargeted it. src/content/docs/workers/ai/ has never existed in repo history, so this reads as a copy-paste of the wrong product. Retargeted to /workers-ai/. Corrections: - Availability was "only available to accounts on a Free plan". There is no plan gate in the implementation; it is Free plus select Enterprise. Points Enterprise readers at their account team. - "Does not currently reference previous conversation context" and "cannot remember previous conversations" are both false since CFSA-1042 shipped list/search/get/summarize over your own conversations, ungated. - Retention is measured from last activity, not creation, so an active conversation is not purged mid-use (agent.ts:5609-5619). - Generative UI said charts render inline in the chat panel. Only the artifact card does; everything else is a card that opens the full-screen view. - Softened the support limitation, which flatly denied what the support-case handoff now does. Additions, all verified in the implementation: - Undo a change (prepareRevert), live in production per wrangler.jsonc:320. - Support case handoff, with confirmation and eligibility framed by support entitlement rather than plan name. - Dashboard page search, entitlement and plan-tier lookups, product skills and changelog-grounded answers. - AI Gateway in the "Built on Cloudflare" table; model requests go through it (model.ts:26-30). Deliberately not documented: the decision rail, which is disabled in production (DECISION_RAIL_ENABLED false, wrangler.jsonc:321), and image attachments, which are still a draft spec with no inbound image path. --- public/__redirects | 2 +- src/content/docs/agent-lee/index.mdx | 59 +++++++++++++++++-- src/content/docs/ai/index.mdx | 6 +- .../docs/ai/related-products/agent-lee.mdx | 9 +++ .../ai/related-products/cloudflare-agent.mdx | 10 ---- .../docs/ai/related-products/index.mdx | 6 +- src/icons/cloudflare-agent.svg | 1 - 7 files changed, 69 insertions(+), 24 deletions(-) create mode 100644 src/content/docs/ai/related-products/agent-lee.mdx delete mode 100644 src/content/docs/ai/related-products/cloudflare-agent.mdx delete mode 100644 src/icons/cloudflare-agent.svg diff --git a/public/__redirects b/public/__redirects index b3b8502f883..a59c56750c7 100644 --- a/public/__redirects +++ b/public/__redirects @@ -2449,7 +2449,7 @@ /workers/tutorials/store-data-with-fauna/ https://fauna.com/blog/the-future-of-fauna 301 /workers/tutorials/live-cursors-with-nextjs-rpc-do/ /resources/ 301 /workers/tutorials/automated-analytics-reporting/ /resources/ 301 -/workers/ai/ /agent-lee/ 301 +/workers/ai/ /workers-ai/ 301 /cloudflare-agent/ /agent-lee/ 301 /workers/development-testing/ /workers/local-development/ 301 /workers/development-testing/bindings-per-env/ /workers/local-development/bindings-per-env/ 301 diff --git a/src/content/docs/agent-lee/index.mdx b/src/content/docs/agent-lee/index.mdx index c1514c8e89b..b65135345e7 100644 --- a/src/content/docs/agent-lee/index.mdx +++ b/src/content/docs/agent-lee/index.mdx @@ -22,18 +22,26 @@ An AI co-pilot built into the Cloudflare dashboard. Ask questions about your acc :::note[Beta] -Agent Lee is currently in beta and only available to accounts on a Free plan. Features and behaviors may change. +Agent Lee is currently in beta and available to accounts on a Free plan and to select Enterprise customers. Features and behaviors may change. + +If you are on an Enterprise plan and would like access, contact your account team. ::: With Agent Lee, you can: - Ask questions about your account configuration and get answers based on your actual data. - Make changes to DNS records, zone settings, and security rules, with your approval required before anything executes. +- Undo a change Agent Lee made earlier in the conversation. - Run network diagnostics like DNS lookups and certificate checks. -- Generate inline charts and visualizations from your account analytics. +- Generate charts and visualizations from your account analytics. +- Find the right dashboard page for a task. +- Revisit your earlier conversations with Agent Lee. +- Open a Cloudflare Support case, if your account is eligible. To get started, log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select **Ask AI** in the upper-right corner of any dashboard page. +Agent Lee was previously referred to as Cloudflare Agent. + --- ## Capabilities @@ -42,6 +50,8 @@ To get started, log in to the [Cloudflare dashboard](https://dash.cloudflare.com Agent Lee answers based on your actual account data, not just documentation. When you ask a question, it fetches your zone configuration, DNS records, and security settings before responding. +It can also tell you whether your account is entitled to a particular Cloudflare feature, and which plan tier you are on, so you know whether something is available to you before you try to configure it. + ### Write operations You can ask Agent Lee to create, update, or delete resources across your account using natural language. Every write operation requires your explicit approval before it executes, Agent Lee shows you exactly what it plans to do and waits for confirmation. @@ -52,6 +62,10 @@ Example requests: - "Enable Always Use HTTPS on my zone." - "Set the SSL mode for example.com to Full (strict)." +### Undo a change + +If Agent Lee made a change earlier in the conversation and you want to reverse it, ask it to undo the change. Agent Lee works out the inverse operation and presents it to you as a proposed write, which you approve in the same way as any other change. Undo is not automatic, and it cannot reverse changes made outside of Agent Lee. + ### Network diagnostics Run diagnostic commands to troubleshoot connectivity and configuration issues: @@ -62,12 +76,43 @@ Run diagnostic commands to troubleshoot connectivity and configuration issues: ### Generative UI -Agent Lee renders inline charts and data visualizations directly in the chat panel based on your account analytics. +Agent Lee builds charts, tables, and metric summaries from your account analytics. Most visualizations appear in the chat panel as a card that you select to open the full-screen view. + Example requests: - "Show me a chart of my traffic over the last 7 days." - "What does my error rate look like for the past 24 hours?" +### Dashboard navigation + +Agent Lee searches the dashboard's page index rather than guessing at URLs, so it can point you to the exact page for a task. Links open on the account you currently have selected. + +Example requests: + +- "Where do I configure page rules for example.com?" +- "Take me to my R2 bucket settings." + +### Conversation history + +Agent Lee can list, search, and summarize your previous conversations, so you can pick up where you left off without repeating context. + +Example requests: + +- "What did we decide about the SSL settings last week?" +- "Summarize my last conversation." + +Agent Lee treats past conversation context as supplemental. It re-reads your live account data before answering rather than relying on what was true in an earlier session. + +### Support case handoff + +If Agent Lee cannot resolve your issue and your account is eligible for ticket-based support, it can prepare a Cloudflare Support case for you. Agent Lee always shows you the case and waits for your confirmation before filing anything — it never opens a case silently. + +Eligibility depends on your support entitlement rather than your plan name alone. Accounts on a Free plan can file billing disputes, such as a duplicate charge or a charge after cancelling. Agent Lee limits how many cases you can open per account within a 24-hour period. + +### Product knowledge + +Agent Lee has built-in guidance for individual Cloudflare products — including DNS, SSL/TLS, R2, Workers, Cloudflare Tunnel, Gateway, Access, and WARP — and searches the Cloudflare developer documentation and changelog when it needs more detail. Grounding answers in the published changelog means Agent Lee will tell you when a product you asked about does not exist, rather than inventing one. + --- ## Data access and privacy @@ -90,7 +135,9 @@ Agent Lee fetches this data on demand when your question requires it. ### Conversation storage -Conversations are stored per user using [Durable Objects](/durable-objects/), isolated to your account. Conversation data is retained for one year in accordance with Cloudflare's data retention policy. Agent Lee does not currently reference previous conversation context when responding. +Conversations are stored per user using [Durable Objects](/durable-objects/). Conversation data is retained for one year in accordance with Cloudflare's data retention policy, measured from the last time you sent a message, so an actively used conversation is not purged while you are still working in it. + +Agent Lee can list, search, and summarize conversations you have had with it. It cannot read another user's conversations. ### Data usage @@ -103,10 +150,9 @@ Agent Lee does not currently use your conversations, prompts, or account data to Agent Lee cannot: - Deploy applications on your behalf or run code for you (it can generate small starter projects and [export the source](/agent-lee/take-home-code/) for you to clone) -- Replace [Cloudflare Support](https://support.cloudflare.com) for billing issues, account recovery, or outages +- Replace [Cloudflare Support](https://support.cloudflare.com) for account recovery or outages (it can prepare a support case for you, but only if your account is eligible and you confirm it) - Access payment methods, billing history, or API tokens - Operate across multiple accounts: sessions are scoped to your authenticated account -- Remember previous conversations: each session starts fresh - Query raw log data or Logpush datasets - Execute write operations without your explicit approval @@ -123,6 +169,7 @@ Agent Lee is built on Cloudflare's own developer platform using the same primiti | [Agents SDK](/agents/) | Agent lifecycle, state management, and scheduling | | [Durable Objects](/durable-objects/) | Per-user conversation storage and write approval gate | | [Workers AI](/workers-ai/) | LLM inference | +| [AI Gateway](/ai-gateway/) | Model request routing, logging, and analytics | | [Cloudflare MCP server](/agents/model-context-protocol/apis/agent-api/) | Tool definitions for Cloudflare API operations | --- diff --git a/src/content/docs/ai/index.mdx b/src/content/docs/ai/index.mdx index 4fa94c714d2..402a9ee161c 100644 --- a/src/content/docs/ai/index.mdx +++ b/src/content/docs/ai/index.mdx @@ -75,9 +75,9 @@ Explore all AI models available through Cloudflare, including hosted models on W An AI-powered assistant that helps you navigate, configure, and manage Cloudflare. diff --git a/src/content/docs/ai/related-products/agent-lee.mdx b/src/content/docs/ai/related-products/agent-lee.mdx new file mode 100644 index 00000000000..33fe4be9e0c --- /dev/null +++ b/src/content/docs/ai/related-products/agent-lee.mdx @@ -0,0 +1,9 @@ +--- +title: Agent Lee +description: Use Agent Lee as an AI-powered assistant to navigate, configure, and manage Cloudflare. +sidebar: + order: 8 +external_link: /agent-lee/ +products: + - ai +--- diff --git a/src/content/docs/ai/related-products/cloudflare-agent.mdx b/src/content/docs/ai/related-products/cloudflare-agent.mdx deleted file mode 100644 index 395d841a550..00000000000 --- a/src/content/docs/ai/related-products/cloudflare-agent.mdx +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: Cloudflare Agent -description: Use Cloudflare Agent as an AI-powered assistant to navigate, configure, and manage Cloudflare. -sidebar: - order: 8 -external_link: /cloudflare-agent/ -products: - - ai - - browser-run ---- diff --git a/src/content/docs/ai/related-products/index.mdx b/src/content/docs/ai/related-products/index.mdx index d9a5010c6e1..e4da94a7b6f 100644 --- a/src/content/docs/ai/related-products/index.mdx +++ b/src/content/docs/ai/related-products/index.mdx @@ -52,9 +52,9 @@ import { RelatedProduct } from "~/components"; An AI-powered assistant that helps you navigate, configure, and manage Cloudflare. diff --git a/src/icons/cloudflare-agent.svg b/src/icons/cloudflare-agent.svg deleted file mode 100644 index 9cb48ec8928..00000000000 --- a/src/icons/cloudflare-agent.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file From 5a97c1de01f1a52f5fb293b47ee1a1bfc3833836 Mon Sep 17 00:00:00 2001 From: Kylie Czajkowski Date: Wed, 23 Sep 2026 22:28:33 -0700 Subject: [PATCH 2/2] [Agent Lee] Document access and permission controls Adds agent-lee/manage-access, covering controls that exist today and were completely undocumented: hiding the assistant, permission templates, custom scopes, when permission changes take effect, the admin write restriction, and auditing the API tokens Agent Lee holds. Links it from the overview's write-operations section and related resources. Verified against stratus and cloudflare-agent rather than carried over from an earlier draft. Corrections made while verifying: - Shortcuts are Cmd//Ctrl+/ and the `t` `a` sequence (AuthenticatedApp.tsx:195, DashHotkeys/constants.ts:96-101). The draft listed only the first and only for macOS. - Custom scopes are a curated list across eight categories with independent read/write toggles, not per-product, and not the full API-token catalogue. - Four areas are hard-denied for write regardless of selection: account settings, membership, billing, API tokens (api/token.ts DENIED_WRITE_PATTERNS). - The admin indicator reads "Write off" with a tooltip, not "Write disabled by admin". - Permission changes apply on the next message in the same conversation (agent.ts:3593-3599). The draft claimed the current conversation keeps the old permissions, which is wrong. Wording chosen to stay true in the failure cases: - Opt-out "attempts to delete" the API token rather than guaranteeing revocation, because the client path is fire-and-forget and can no-op when the token id read is stale (useLeeEnabledSetting.ts:217-223). - Permission changes say both tokens "may exist briefly" rather than claiming atomic replacement; the flow creates the new token before revoking the old (PermissionStore.ts:523-539). - Both cases point the reader at My Profile > API Tokens, which is the reliable way to confirm access is gone. Not documented, because they are internal rather than customer-facing: the account-wide disable API (CFSA-596, no dashboard UI, internal Flagship flag) and account write policies (CFSA-1044, AX-team-only admin app behind Cloudflare Access). The preferences card is still labelled "Cloudflare Agent" in the dashboard (common.json:38) while the sidebar says "Agent Lee". The page uses the on-screen label so readers can find the control, and notes the discrepancy. Resolving it needs a product-side string change. --- src/content/docs/agent-lee/index.mdx | 3 + src/content/docs/agent-lee/manage-access.mdx | 127 +++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100644 src/content/docs/agent-lee/manage-access.mdx diff --git a/src/content/docs/agent-lee/index.mdx b/src/content/docs/agent-lee/index.mdx index b65135345e7..eeff4575b93 100644 --- a/src/content/docs/agent-lee/index.mdx +++ b/src/content/docs/agent-lee/index.mdx @@ -56,6 +56,8 @@ It can also tell you whether your account is entitled to a particular Cloudflare You can ask Agent Lee to create, update, or delete resources across your account using natural language. Every write operation requires your explicit approval before it executes, Agent Lee shows you exactly what it plans to do and waits for confirmation. +If you would rather Agent Lee never change anything, you can grant it [read-only access](/agent-lee/manage-access/), which leaves questions and diagnostics available. + Example requests: - "Add an A record for blog.example.com pointing to 192.0.2.10." @@ -177,6 +179,7 @@ Agent Lee is built on Cloudflare's own developer platform using the same primiti ## Related resources - [Export generated code](/agent-lee/take-home-code/) +- [Manage access and permissions](/agent-lee/manage-access/) - [Agents SDK](/agents/) - [Human in the Loop](/agents/concepts/agentic-patterns/human-in-the-loop/) - [Workers AI](/workers-ai/) diff --git a/src/content/docs/agent-lee/manage-access.mdx b/src/content/docs/agent-lee/manage-access.mdx new file mode 100644 index 00000000000..4c99d91f1c3 --- /dev/null +++ b/src/content/docs/agent-lee/manage-access.mdx @@ -0,0 +1,127 @@ +--- +title: Manage access and permissions +description: Control whether Agent Lee appears in the dashboard, choose what it is allowed to read and change, and review the API tokens it holds. +pcx_content_type: how-to +tags: + - AI +sidebar: + order: 3 +head: + - tag: title + content: Manage access and permissions +products: + - agent-lee +--- + +import { Description, Steps } from "~/components"; + + + +Control whether Agent Lee appears in the dashboard, choose what it is allowed to read and change, and review the API tokens it holds. + + + +:::note[Beta] +Agent Lee is currently in beta. The controls described here may change, and not every control is available to every account yet. +::: + +Agent Lee acts on your account using an API token that it creates on your behalf, scoped to the permissions you grant. You decide whether the assistant appears at all, what it can read, and whether it can make changes. + +## Open or hide Agent Lee + +Select **Ask AI** in the upper-right corner of any dashboard page, or use a keyboard shortcut: + +- `Cmd` + `/` on macOS, or `Ctrl` + `/` on Windows and Linux. +- Press `t` then `a` to toggle the sidebar. + +### Turn Agent Lee off + +If you do not want to use Agent Lee, you can hide it from the dashboard entirely. + + + +1. In the Cloudflare dashboard, go to **Configurations** > **Preferences** for your account. + +2. Find the **Cloudflare Agent** card and turn the setting off. + + + +:::note +The dashboard has not finished adopting the Agent Lee name. This preference is still labelled **Cloudflare Agent**. +::: + +Turning the setting off hides the **Ask AI** sidebar and disables the keyboard shortcuts, and the assistant loses its stored copy of your API token, so it can no longer reach your account. The dashboard also attempts to delete the underlying API token for you. To confirm the token is gone — or to remove it yourself — see [Review the tokens Agent Lee holds](#review-the-tokens-agent-lee-holds). + +Turning the setting back on does not restore access automatically. You are asked to grant permissions again the next time you open the assistant. + +Turning Agent Lee off does not delete your conversation history. + +## Choose what Agent Lee can access + +When you first grant access, you choose how much of your account the assistant can use. Depending on your account, you may see the following permission templates: + +| Template | What it allows | +| --- | --- | +| **Full access** | Read your resources, and propose changes. Every write still requires your approval before it executes. | +| **Read only** | Read and inspect your resources. Agent Lee cannot change anything. | +| **Custom** | Choose individual permissions yourself. | + +**Full access** does not mean unattended access. Agent Lee shows you exactly what it intends to do and waits for your confirmation before any change is made. + +### Custom permissions + +**Custom** opens a curated list of permissions grouped into categories such as Developer Platform, DNS and Zones, App Security, AI, Cloudflare One, Analytics and Logs, and Account. Each entry has independent read and write toggles, and you choose which accounts the grant applies to. + +This list is a subset of everything a Cloudflare API token can express — it covers the products Agent Lee knows how to work with, not the entire API surface. + +### What Agent Lee can never change + +Some permissions are withheld no matter which template you pick or what you select under **Custom**. Agent Lee cannot write to: + +- Account settings +- Account membership +- Billing +- API tokens + +## When permission changes take effect + +Changing permissions issues a new API token with the updated scope and replaces the one the assistant was using. The previous token is then deleted. Because the new token is created before the old one is removed, both may exist briefly. + +Permission changes apply to your next message. Actions the assistant has already completed are not affected, and you do not need to start a new conversation for a change to take effect. + +## Write access disabled by an administrator + +An account administrator can prevent Agent Lee from making changes on your behalf. When this applies to you, the assistant shows a **Write off** indicator with a lock icon near the message box, and the tooltip reads: + +> Write access has been disabled for your account by an administrator. You can still read and inspect resources. + +In this state Agent Lee can still answer questions, run diagnostics, and inspect your configuration, but it cannot create, update, or delete anything. You cannot lift the restriction yourself — contact your account administrator. + +The restriction applies only to the account where it was set. Your permissions on other accounts are unchanged. + +## Review the tokens Agent Lee holds + +Agent Lee's tokens appear alongside your own. To audit or remove them: + + + +1. Go to **My Profile** > **API Tokens** in the Cloudflare dashboard. + +2. Look for tokens named `Cloudflare Agent Token -` followed by a date. + +3. Delete any token you no longer want. Deleting the token the assistant is currently using revokes its access immediately; you are asked to grant permissions again the next time you open it. + + + +Reviewing this list is the reliable way to confirm that access has been removed after you turn Agent Lee off or narrow its permissions. + +## Availability + +Agent Lee is not available in the Cloudflare FedRAMP environment. + +Availability is still rolling out, so the assistant and the controls on this page may not appear on every account yet. + +## Related resources + +- [Agent Lee overview](/agent-lee/) +- [Cloudflare API tokens](/fundamentals/api/get-started/create-token/)