State management and storage with policy enforcement in a distributed cloud computing network

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to carry out the operations comprising:

• instantiating a first object worker on a first compute server of a plurality of compute servers of a distributed cloud computing network, wherein the first object worker is associated with a first object, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;
• receiving, at a first compute server, a first request for the first object worker to send a first communication with the first object to a first asset that is on a first network that is external to the distributed cloud computing network;
• accessing a first set of one or more policies that are applicable for processing the first object, wherein the first set of one or more policies include an external communication policy;
• determining, based on an external communication policy associated with the first object worker, that the first object worker is not allowed to send the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network, and responsive to this determination, preventing the first object worker from sending the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network;
• receiving, at the first compute server, a second request for the first object worker to send a second communication with the first object to a second asset that is on a second network that is external to the distributed cloud computing network;
• accessing the first set of one or more policies that are applicable for processing the first object;
• and
• determining, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the second communication with the first object to the second asset that is on the second network that is external to the distributed cloud computing network, and responsive to this determination, allowing the first object worker to send the second communication with the first object to the second asset.

A first compute server, comprising:

• a processor;
• and
• a non-transitory machine-readable storage medium coupled to the processor, wherein the non-transitory machine-readable storage medium stores instructions that, when executed by the processor, causes the server to perform operations including:
• instantiate a first object worker on the first compute server of a plurality of compute servers of a distributed cloud computing network, wherein the first object worker is associated with a first object, and wherein the first object worker includes a single instantiation of a first piece of code that solely controls reading and writing to the first object;
• receive, at the first compute server, a first request for the first object worker to send a first communication with the first object to a first asset that is on a first network that is external to the distributed cloud computing network;
• access a first set of one or more policies that are applicable for processing the first object, wherein the first set of one or more policies include an external communication policy;
• determine, based on an external communication policy associated with the first object worker, that the first object worker is not allowed to send the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network, and responsive to this determination, prevent the first object worker from sending the first communication with the first object to the first asset that is on the first network that is external to the distributed cloud computing network;
• receive, at the first compute server, a second request for the first object worker to send a second communication with the first object to a second asset that is on a second network that is external to the distributed cloud computing network;
• access the first set of one or more policies that are applicable for processing the first object;
• and
• determine, based on the external communication policy associated with the first object worker, that the first object worker is allowed to send the second communication with the first object to the second asset that is on the second network that is external to the distributed cloud computing network, and responsive to this determination, allowing the first object worker to send the second communication with the first object to the second asset.