Origin Shield helps only when the regional mid-tier and the edge share a stable cache key. If Cookie, Authorization, or an unbounded query string still enters the key on a public path, Shield just concentrates a MISS storm onto one region instead of reducing origin GETs. Prefer normalizing the key for hashed static objects, keep HTML or other non-hashed shells on short TTL or a tagged invalidation, and place Shield in a region that already absorbs the majority of origin fills so cold POPs refill from Shield rather than from the origin on every deploy wave.

Ops prove-out after enabling Shield or tightening the cache policy: hit the same URL twice and read Age / X-Cache together with origin request rate for that host. A healthy pattern is edge MISS then Shield HIT (or a second-edge HIT) without a matching origin spike. After a purge, confirm every behaviour that could still hold the old object is covered — a single un-normalized query variant left in the key looks like Shield “not working” when the real issue is cache-key cardinality.