Protection is opt-in per app. Changes here update the IAM registry and record an audit event; Cloudflare Access integration is shown separately for existing policies.