diff --git a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx
index 10be6ed5fa661d3..cdb8d790d59936f 100644
--- a/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx
+++ b/src/content/docs/cloudflare-one/policies/gateway/application-app-types.mdx
@@ -5,7 +5,7 @@ sidebar:
order: 9
---
-import { GlossaryDefinition, GlossaryTooltip } from "~/components";
+import { GlossaryDefinition, GlossaryTooltip, Details } from "~/components";
Gateway allows you to create DNS, Network, and HTTP policies based on applications and app types. You can select individual applications or groups of app types to filter specific traffic on your network.
@@ -45,6 +45,80 @@ Gateway sorts applications into the following app type groups:
| Video Streaming | Video streaming applications |
| [Do Not Inspect](#do-not-inspect-applications) | Applications incompatible with the TLS certificate required by the [Gateway proxy](/cloudflare-one/policies/gateway/proxy/) |
+## Application controls
+
+With [Cloud App Control](/cloudflare-one/policies/gateway/http-policies/#cloud-app-control), you can choose specific actions and operations to match application traffic. Supported applications and operations include:
+
+
+
+| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content |
+| ---------------- | ------------------- | ------------------ | ------------ | -------------------------- | ---------------------- | ----------- |
+| Chat | `1650` | SendPrompt | `8004` | Prompt | `1652` | ✅ |
+| Chat | `1650` | UploadFile | `8008` | Upload | `1653` | ❌ |
+| Chat | `1650` | UploadFilePayload | `8013` | Upload | `1653` | ✅ |
+| Chat | `1650` | ShareResponse | `8006` | Share | `1654` | ❌ |
+| Chat | `1650` | ShareCanvas | `8007` | Share | `1654` | ❌ |
+| Chat | `1650` | TranscribeVoice | `8011` | Voice | `1655` | ❌ |
+| Chat | `1650` | EnableVoiceMode | `8003` | Voice | `1655` | ❌ |
+| Settings | `1651` | AllowTraining | `8009` | | | ❌ |
+| Settings | `1651` | AllowVoiceTraining | `8010` | | | ❌ |
+| Settings | `1651` | AllowVideoTraining | `8016` | | | ❌ |
+| Settings | `1651` | ExportData | `8020` | | | ❌ |
+
+
+
+
+
+| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content |
+| ---------------- | ------------------- | ----------------- | ------------ | -------------------------- | ---------------------- | ----------- |
+| Chat | `1656` | SendPrompt | `8021` | Prompt | `1657` | ✅ |
+| Chat | `1656` | UploadFile | `8022` | Upload | `1658` | ❌ |
+| Chat | `1656` | UploadFilePayload | `8023` | Upload | `1658` | ✅ |
+| Chat | `1656` | TranscribeVoice | `8025` | Voice | `1659` | ❌ |
+
+
+
+
+
+| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content |
+| ---------------- | ------------------- | ---------------------- | ------------ | -------------------------- | ---------------------- | ----------- |
+| Chat | `2596` | SendPrompt | `11947` | Prompt | `2598` | ✅ |
+| Chat | `2596` | ClarifyingPrompt | `11951` | Prompt | `2598` | ✅ |
+| Chat | `2596` | CreateUploadUrl | `11948` | Upload | `2599` | ❌ |
+| Chat | `2596` | UploadFile | `11955` | Upload | `2599` | ✅ |
+| Settings | `2597` | UploadOrganizationFile | `11950` | Upload | `2599` | ❌ |
+| Chat | `2596` | ShareChat | `11952` | Share | `2600` | ❌ |
+| Chat | `2596` | VoiceTranscription | `11953` | Voice | `2601` | ❌ |
+| Chat | `2596` | ExportChat | `11949` | | | ❌ |
+| Chat | `2596` | DeleteThread | `11954` | | | ❌ |
+| Settings | `2597` | DeleteOrganizationFile | `11956` | | | ❌ |
+
+
+
+
+
+| Operations group | Operations group ID | Operation name | Operation ID | Application Controls group | Application control ID | DLP content |
+| ---------------- | ------------------- | --------------------- | ------------ | -------------------------- | ---------------------- | ----------- |
+| Chat | `2126` | SendPrompt | `10048` | Prompt | `2127` | ✅ |
+| Chat | `2126` | PromptCompletion | `10050` | Prompt | `2127` | ✅ |
+| Chat | `2126` | RetryPromptCompletion | `10040` | Prompt | `2127` | ✅ |
+| Chat | `2126` | UploadFile | `10039` | Upload | `2128` | ✅ |
+| Chat | `2126` | ConvertDocument | `10041` | Upload | `2128` | ✅ |
+| Chat | `2126` | ShareConversation | `10043` | Share | `2129` | ❌ |
+| Chat | `2126` | GetShares | `10052` | Share | `2129` | ❌ |
+| Chat | `2126` | CreateConversation | `10038` | | | ❌ |
+| Chat | `2126` | GetConversation | `10046` | | | ❌ |
+| Chat | `2126` | UpdateConversation | `10047` | | | ❌ |
+| Chat | `2126` | DeleteConversation | `10045` | | | ❌ |
+| Settings | `2125` | UpdateAccount | `10036` | | | ❌ |
+| Settings | `2125` | InitiateDataExport | `10037` | | | ❌ |
+| Chat | `2126` | GiveFeedback | `10042` | | | ❌ |
+| Chat | `2126` | SetConversationTitle | `10044` | | | ❌ |
+| Settings | `2125` | GetOrganisation | `10049` | | | ❌ |
+| Chat | `2126` | GetFilePreview | `10051` | | | ❌ |
+
+
+
## Usage
### Overlapping hostnames
diff --git a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx
index 17a374708bc9e9d..ae0a7345f2ec7ef 100644
--- a/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx
+++ b/src/content/docs/cloudflare-one/policies/gateway/http-policies/index.mdx
@@ -401,6 +401,16 @@ Gateway matches HTTP traffic against the following selectors, or criteria:
When using Terraform to create a policy with the [Do Not Inspect](#do-not-inspect) action, you must use the `app.hosts_ids` and `app.supports_ids` selectors. For example, to create a Do Not Inspect policy for Google Cloud Platform traffic, create a policy with both `any(app.hosts_ids[*] in {1245})` and `any(app.supports_ids[*] in {1245})`.
:::
+#### Cloud App Control
+
+When using the _is_ operator with the _Application_ selector, you can use Cloud App Control to choose specific actions and operations to match application traffic. For example, you can block file uploads to ChatGPT without blocking all ChatGPT traffic:
+
+| Selector | Operator | Value | Controls | Action |
+| ----------- | -------- | --------- | -------- | ------ |
+| Application | is | _ChatGPT_ | _Upload_ | Block |
+
+You can match traffic based on **Application Controls**, which group multiple user actions together, or **Operations**, which allow for granular control of supported API-level actions for an application. For a list of supported granular controls, refer to [Application controls](/cloudflare-one/policies/gateway/application-app-types/#application-controls).
+
### Content Categories