The Edge Layer MVP: Visibility, Blocking, Deployment, And The App-Coupled WAF

Summary

The first MVP scoping: visibility (real-time logs replacing Firehose), blocking (a WAF that knows the app it protects), deployment (create/destroy/teardown, automated and visualised). Its central insight names the differentiator: most WAFs operate blind to the application they protect, which is the source of their complexity and their false positives; coupling the guard to the app inverts that. It also introduces the two-way conversation with edge functions — ping them, query them, ask what they know, configure them through an API — and the "what do you know about me?" transparency feature for legitimate users.

Key concepts

• The app-coupled WAF — the intelligence comes from the application, not from generic threat databases
• The three MVP problems — visibility, blocking, deployment — what the built MVP answers
• Don't play ball with attackers — drop silently, deflect, waste their time — asymmetry as a stance

Key ideas

• Legitimate users get transparency and minimal capture; suspected attackers get opacity and friction — the edge can tell the difference because it knows what good looks like.
• Optimise at the right altitude: shaving 5ms off a Lambda that then makes a 50ms network call is wasted effort.
• The MVP is judged against concrete debugging goals (clone traffic, too-many-requests, mobile load), not abstract WAF feature checklists.

On this site

The visibility and blocking use cases became the MVP's two use cases; the deployment discipline became sg sentinel deploy.

Read the document