Cloudflare OS 与影子 AI 问题：四个真正能兜住的控制点

影子 AI 首先是清单问题，然后才是政策问题

我见过的失败治理项目，都栽在同一步：为一个从没数清楚过的人群写政策。在你能判断哪些 AI 工具可接受之前，你需要知道机器到底在跟哪些端点通信、出去了多少数据、是谁在发。

出网日志一个下午就能给你这些，而排序指标不是请求数。一个只有十次请求却上传了两个 GB 的厂商，比一万次小请求的厂商问题更大。按出网字节排序，再看用户分布：某个用户往未批准的域名大量上传，那是一次谈话，不是一条政策。

这也是能拿去做商业论证的那个数字。当有人问「为什么要为托管工作区付钱」时，「上个月有 11 个未批准的 AI 厂商从财务部收到了 4.2 GB」比任何架构图都有说服力。

# You cannot govern what you have not inventoried. Start with egress logs: which
# AI endpoints your fleet actually talks to, and who the top talkers are.

import json
from collections import Counter, defaultdict

AI_SUFFIXES = (
    "openai.com", "anthropic.com", "generativelanguage.googleapis.com",
    "openrouter.ai", "huggingface.co", "mistral.ai", "cohere.ai",
    "deepseek.com", "moonshot.cn", "bigmodel.cn",
)

def is_ai(host: str) -> bool:
    return any(host.endswith(s) for s in AI_SUFFIXES)

requests = Counter()
bytes_out = Counter()
users = defaultdict(set)

for line in open("egress.jsonl"):
    r = json.loads(line)
    if not is_ai(r["host"]):
        continue
    requests[r["host"]] += 1
    bytes_out[r["host"]] += r.get("bytes_out", 0)
    users[r["host"]].add(r["user"])

for host, n in requests.most_common(15):
    print(f"{host:45} req={n:6} out={bytes_out[host]/1e6:8.1f}MB users={len(users[host])}")

# Bytes-out is the number that matters. A host with few requests and huge uploads
# is the one to look at first, not the one with the highest request count.

连接器就是新的防火墙规则

一键接入 Asana、Box、GitHub、Notion 确实好用，也确实危险，而且两者成正比。真正兜得住的控制，是把最小权限写成数据：哪个连接器、哪些 scope、哪些团队、读还是写。写成数据，是因为这样评审就变成一次 diff，例外也能挂上名字。

Cloudflare 的表述是：工作区让管理员在几分钟内连上这些资源，而且工具拿到的数据权限不会超过必要范围。注意后半句是一张 scope 清单，不是给模型的一句指令。「不要访问超出必要的数据」作为散文无法执行，作为 scope 集合可以。

先只给读。一个对记录系统有写权限的连接器，等于用一句提示词部署了一次生产变更，而回滚方案通常是缺的。等你看过一个团队两周的读用量、知道正常长什么样之后，再谈写权限。

# Connectors are the new firewall rules. Write them as data, so a review is a diff
# and an exception has a name attached to it.

CONNECTORS = {
  "notion": {"scopes": ["read:pages"], "data_class": "internal",
             "allowed_teams": ["docs", "eng"], "write": False},
  "github": {"scopes": ["repo:read", "pr:create"], "data_class": "source",
             "allowed_teams": ["eng"], "write": True},
  "box":    {"scopes": ["read:folder:finance"], "data_class": "confidential",
             "allowed_teams": ["finance"], "write": False},
}

def validate(request):
    c = CONNECTORS.get(request["connector"])
    if not c:
        return "DENY: connector not approved"
    if request["team"] not in c["allowed_teams"]:
        return f"DENY: team {request['team']} not allowed for {request['connector']}"
    if request["write"] and not c["write"]:
        return "DENY: write not permitted on this connector"
    over = set(request["scopes"]) - set(c["scopes"])
    if over:
        return f"DENY: scopes not approved -> {sorted(over)}"
    return "ALLOW"

# Least privilege has to be enforced at the connector, not requested in a prompt.
# "Do not access more data than necessary" is a scope list, not an instruction.
print(validate({"connector": "box", "team": "eng", "write": False,
                "scopes": ["read:folder:finance"]}))

token 预算没有主人，就只是个数字

新闻稿提到用 AI Gateway 把任务路由到合适的模型，以遏制失控的 token 账单——这个架构直觉是对的：把执行点放在调用发生的地方，而不是月报里。但这个机制只有在花费能归到某个可以被追问的团队时才成立。

两种失败模式都很常见。没有主人的硬上限会造成没人预料到的中断，因为撞上限的人根本不知道有上限。没有告警的软上限会造成没人注意到的账单，因为告警发到了没人看的频道。

能用的版本有三个属性：归因到团队、有明确的主人、错误信息用户能据以行动。被拦下时提示「eng 预算已用尽，负责人是 X，在这里申请提额」很烦，但被拦下时只返回一个 403 就是事故。

# Token budgets only work if they are enforced below the UI. Check at the gateway,
# attribute to a team, and fail closed with a clear error instead of a surprise bill.

from dataclasses import dataclass

@dataclass
class Budget:
    team: str
    monthly_usd: float
    hard_stop: bool = True

BUDGETS = {
    "eng":     Budget("eng", 900.0),
    "support": Budget("support", 250.0, hard_stop=False),
}

def check(team: str, spent_usd: float, requested_usd: float) -> dict:
    b = BUDGETS.get(team) or Budget(team, 0.0)
    projected = spent_usd + requested_usd
    if projected <= b.monthly_usd:
        return {"allow": True, "remaining": round(b.monthly_usd - projected, 2)}
    if b.hard_stop:
        return {"allow": False, "reason": f"{team} budget exhausted",
                "remaining": round(b.monthly_usd - spent_usd, 2)}
    return {"allow": True, "reason": "soft cap exceeded, alerting owner",
            "remaining": 0.0}

# The point of attribution is that somebody can be asked a question about it.
# A budget with no owner is a number, not a control.
print(check("eng", 880.0, 40.0), check("support", 240.0, 40.0))

试点团队就是对照组，跳过这一步，推广就变成了讲故事。

评审 AI 生成的代码，但别假装能检测出来

新闻稿列的问题里有「AI 生成的代码未经评审就上线」。直觉是去做检测器。别做，因为从源码判断作者归属不可靠、有争议，而且随着模型越来越会模仿周围代码风格只会更差。

改成要求归属信息。一个写明助手名称的 commit trailer 是可审计的、便宜的，也不依赖任何人对风格的判断。然后划出特权路径——迁移脚本、基础设施、IAM——要求这些提交里有具名的人类评审者。规则简单到脚本能执行，开发者十秒能满足。

这跟大多数治理的取舍一样：让诚实的路径变成简单的路径，并让简单的路径可见。被告知哪些提交涉及智能体的评审者，读代码的方式会不一样，那个差异才是真正的控制。

#!/usr/bin/env bash
# Review gate for AI-generated code. Do not try to detect "AI-ness" — nobody can.
# Require attribution instead, then allow policy by path and by author.

set -euo pipefail

BASE="${1:-origin/main}"

for sha in $(git rev-list "$BASE"..HEAD); do
  msg=$(git log -1 --format=%B "$sha")
  files=$(git show --pretty="" --name-only "$sha")

  # convention: a trailer, added by whoever ran the agent
  if ! grep -qi '^Assisted-by:.*ai' <<<"$msg"; then
    echo "WARN $sha no AI attribution trailer"
  fi

  # high-risk paths need a human reviewer named in the commit
  if grep -Eq '(\.sql$|migrations/|infra/|iam/)' <<<"$files"; then
    grep -qi '^Reviewed-by:' <<<"$msg" || {
      echo "BLOCK $sha touches privileged paths without Reviewed-by"; exit 1; }
  fi
done

echo "review gate passed"
# That is the whole mechanism: attribution is auditable, intent is not.

推广顺序本身就是控制

最诱人的推广方式是第一周全员开通，因为工具让这件事变成一个复选框。这也正是三个月后你完全不知道一个任务成本多少、哪些流程真的变好了、评审质量有没有变化的原因。没有度量的开通是订阅，不是项目。

一个试点团队加一个可度量的工作流，会给你两个真正重要的数字：每个完成任务的花费，和每次变更的评审时间。如果单任务成本下降、评审时间持平，你才有可复制的东西；如果成本降了而评审时间翻倍，你只是搬走了工作量，并没有消除它——这件事应该在邀请第二个团队之前就知道。

公告里点名的 EPAM、HappyCog 和 Towards AI，做的正是为企业翻译这套东西的活，这本身是个有用的信号：难的部分不是连接器，而是决定一个团队该停止做什么，并证明替代方案更好。

#!/usr/bin/env bash
# Rollout checklist. The order is the control: measure first, expand second.
set -euo pipefail
cat <<'EOF'
[ ] inventory egress to AI endpoints (hosts, bytes out, users)
[ ] pick one pilot team with a measurable workflow
[ ] allowlist connectors for that team only, least scope, read-only first
[ ] set a per-team token budget with a named owner and a hard stop
[ ] require AI attribution trailers + human review on privileged paths
[ ] run 2 weeks; record cost per task, review time, incident count
[ ] publish the numbers to the pilot team before inviting a second team
[ ] expand only if cost per task and incident count both hold
EOF

# The failure mode of every "AI enablement" programme is enabling everyone in week
# one and discovering in month three that nobody knows what a task costs.

归属信息可审计，「这段代码像不像 AI 写的」不可审计。