{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-SAAS-SESSION-01-v1",
  "record_kind": "external_reference",
  "title": "Cloudflare Access: Gateway sessions and SaaS sessions differ",
  "system": "Cloudflare Access",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does an Access application-session limit end the session inside a SaaS app?",
  "near_questions": [
    "Does a gateway session timeout log users out of SaaS?",
    "Which system owns the session inside a SaaS application?",
    "Can a revoked gateway session be created again?",
    "Does identity deactivation differ from session revocation?",
    "What evidence covers an existing application cookie?",
    "Can a gateway limit prove complete offboarding?",
    "Which session durations should procurement compare?",
    "Does logging out of one domain end every application session?",
    "What should an agent verify before reporting access ended?",
    "Can application policy changes affect reauthentication?",
    "When should complete session termination remain unproven?",
    "Can I save an Access and SaaS session review?"
  ],
  "supported_claims": [
    {
      "claim": "Cloudflare documents that the Access duration controls entry to the SaaS application, whose own cookie manages the session inside it. Session revocation also needs to be distinguished from preventing a still-authorised identity from returning. Review both systems before accepting a complete-session-termination claim.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Cloudflare documents that the Access duration controls entry to the SaaS application, whose own cookie manages the session inside it. Session revocation also needs to be distinguished from preventing a still-authorised identity from returning. Review both systems before accepting a complete-session-termination claim.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-S3-PRESIGN-LIFETIME-01-v1",
    "VXI-EXT-PROCUREMENT-AZURE-SAS-REVOCATION-01-v1",
    "VXI-EXT-PROCUREMENT-OKTA-SESSION-TOKEN-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Cloudflare Access sessions and SaaS sessions",
    "source_url": "https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-CLOUDFLARE-SAAS-SESSION-01-v1",
    "candidate_record_sha256": "5bfb0ce3d2c9aaaf5e4fa9273ab2deb2c51dea4092eefff797eb4ea9fcd6b04f",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Cloudflare documents that the Access duration controls entry to the SaaS application, whose own cookie manages the session inside it. Session revocation also needs to be distinguished from preventing a still-authorised identity from returning. Review both systems before accepting a complete-session-termination claim.",
    "required_buyer_context": "Access application type, gateway/session policy, identity status and SaaS session controls.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "The gateway session limit guarantees the user leaves every connected application.",
    "documented_statement": {
      "status": "documented",
      "statement": "Cloudflare documents that the Access duration controls entry to the SaaS application, whose own cookie manages the session inside it. Session revocation also needs to be distinguished from preventing a still-authorised identity from returning. Review both systems before accepting a complete-session-termination claim.",
      "source_ids": [
        "cloudflare-session"
      ]
    },
    "buyer_evidence_required": [
      "Access application type and session configuration.",
      "SaaS-issued session lifetime and termination mechanism.",
      "Identity disablement or policy changes and observed re-entry behaviour."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Keep complete termination unproven without application-session evidence."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "cloudflare-session",
        "url": "https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/",
        "final_url": "https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/",
        "title": "Cloudflare Access sessions and SaaS sessions",
        "checked_on": "2026-10-14",
        "sha256": "c90cc4b8d404a23c598197dd0450f0916d10a9dd72b34e709bd4f1fa6732acd2",
        "bytes": 312651
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Preserve the gap between gateway reauthentication and termination of an existing SaaS session.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Access policy, SaaS session behaviour and identity lifecycle."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#cloudflare-access-saas-session-boundary",
  "machine_readable_record": "/varexis-index/records/cloudflare-access-saas-session-boundary.json"
}