War-game a CDN edge config by testing whether origin maps, cache keys, and purge deadlines still shrink soft coverage when several apps share one POP group and the next traffic spike is close.
Edge configs fail when "covered" means a checkbox without a decision artifact, when teams dual-count a purge as both requested and complete, and when money paths still pin to one origin because the map is incomplete. The review needs one written inventory of edge routes, one owner who can deny a risky rule, and a documented consequence when a failed purge ages past the deadline.
Write the config packet before the change window opens
List routes by hostname, cache behavior, origin pool, last change reason, owner of record, and evidence required to keep the rule. Attach open findings, overdue purges, and any emergency bypass in the last quarter. Name which routes are out of scope and why. If a checkout asset is omitted, show the residual risk in the same packet.
Decide the allow, revise, or hold outcomes in advance. Include the fields that compute stale-cache status so two reviewers reach the same label from the same exports.
Pressure the evidence, not the diagram
| Claim | Evidence required | Fail condition |
|---|---|---|
| Route is covered at the edge | Named origin pool and health check with a measured pass | Map is empty or still points to a single untested origin |
| Purge is complete | Edge export showing object removed for the claimed keys | Ticket closed while export still shows a live object |
| Cache key is unique | Sample responses proving no cross-tenant bleed | Key invents uniqueness the edge never enforced |
| Bypass is controlled | Logged use with time-bound restore | Shared override or unlogged use |
Walk four cases in Pingpong: a static asset still pinned to one region, a purge that left a pricing page live, a cache key that mixed tenant cookies, and a request to skip an admin hostname because traffic is rare. For each case, start from the documented config language. Ask who can extend a change window and which export proves purge. Any step that depends on an unnamed person becomes a config condition.
Replay one prior edge incident under the proposed rules. If the incident would still age without a reverse owner, revise the rules before calling the change ready.
Pair this review with the network ops lead seat and a CDN failover stress test. Cache leftovers after a change often need a cache invalidation stress test. More operating decisions live in the war-game decisions hub.
Close the cycle only when covered and blocked labels can be reproduced from stored exports without a verbal override.