Cloudflare introduces granular access controls for Workers
New role-based permissions enable precise security for teams and agents
1Precise access for production safety
Cloudflare now allows assigning specific Worker access to teammates or agents, preventing unintended production changes. The system enforces the principle of least privilege with four new roles that limit actions per Worker. Users can grant access either through dashboard permissions or API tokens. This prevents agents from making changes beyond their designated scope while maintaining workflow efficiency.
2Four specialized roles introduced
The new roles address different collaboration needs: debug-only, read-only, edit-without-delete, and full admin. Each role corresponds to common development scenarios like debugging, code review, or CI/CD deployment. Cloudflare designed these roles to avoid the pitfalls of either too-broad permissions or overly granular controls. The same roles will extend to other Developer Platform products including D1, R2, and KV in future updates.
3Three-tiered scoping system
Permissions can be applied at three levels: entire Developer Platform, specific product category, or individual resource. For example, metadata read-only access could cover all Workers, just one Worker, or all Developer Platform resources. This hierarchical structure allows teams to balance security with operational needs. The role and scope combination precisely defines what actions are permitted on which resources.
4Debugging without code exposure
The metadata read-only role enables engineers to troubleshoot issues without accessing sensitive code. They can view settings, metrics, logs and traces through the GraphQL API while source code remains protected. When scoped to a single Worker, the permission limits data visibility exclusively to that resource. Cloudflare plans to maintain this separation as the system expands to other platform products.
5Secure CI/CD workflows
CI/CD pipelines can now receive Editor role tokens scoped to individual Workers, preventing system-wide impact if compromised. This containment means misconfigured workflows can only deploy changes to their designated Worker, unable to delete it or affect other applications. The system also separates Worker deployment permissions from domain routing controls for additional security layers.
6Durable Objects permission inheritance
Access to Durable Objects derives from their implementing Worker's permissions. Metadata read-only grants observability data without stored data access, while Editor role is required for direct data interaction. This inheritance model simplifies permission management while maintaining security boundaries. Cloudflare's approach ensures consistent permission structures across different resource types.
7Improved permission error messaging
The platform now provides detailed error messages when users attempt unauthorized actions, specifying required permissions with API documentation links. This helps teams and agents understand exactly what access they need without resorting to broader permissions. The feature reduces troubleshooting time and promotes better permission hygiene across development workflows.
8Future platform-wide consistency
Worker-level controls mark the first step toward unified authorization across Cloudflare's Developer Platform. The same role system will extend to KV namespaces, D1 databases and other resources, replacing account-wide permissions with resource-specific scoping. This evolution will provide consistent security while maintaining operational flexibility as the platform grows.
Original article: Cloudflare Blog — Cloudflare introduces granular access controls for Workers