ADR 0002: Cloudflare Access as the documentation perimeter

• Status: Accepted
• Date: 2026-08-06

Context

A private GitHub repository does not prevent access to an independently published static Pages deployment. The custom domain is not the only URL Pages can expose.

Decision

Cloudflare Access protects the custom domain, default pages.dev hostname, and preview deployment hostnames. Access grants are limited to approved Google Workspace identities or explicit approved email rules.

Consequences

Deployment acceptance includes unauthenticated tests for every hostname class. A custom-domain-only Access policy is insufficient.