# Cloudflare introduces granular access controls for Workers New role-based permissions enable precise security for teams and agents - **Source:** [Cloudflare Blog](https://blog.cloudflare.com) - **Published:** 2026-09-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/e8deb7ca-87fc-4578-bbff-e3f567a4cbad ## Precise access for production safety Cloudflare now allows assigning specific Worker access to teammates or agents, preventing unintended production changes. The system enforces the principle of least privilege with four new roles that limit actions per Worker. Users can grant access either through dashboard permissions or API tokens. This prevents agents from making changes beyond their designated scope while maintaining workflow efficiency. ## Four specialized roles introduced The new roles address different collaboration needs: debug-only, read-only, edit-without-delete, and full admin. Each role corresponds to common development scenarios like debugging, code review, or CI/CD deployment. Cloudflare designed these roles to avoid the pitfalls of either too-broad permissions or overly granular controls. The same roles will extend to other Developer Platform products including D1, R2, and KV in future updates. ## Three-tiered scoping system Permissions can be applied at three levels: entire Developer Platform, specific product category, or individual resource. For example, metadata read-only access could cover all Workers, just one Worker, or all Developer Platform resources. This hierarchical structure allows teams to balance security with operational needs. The role and scope combination precisely defines what actions are permitted on which resources. ## Debugging without code exposure The metadata read-only role enables engineers to troubleshoot issues without accessing sensitive code. They can view settings, metrics, logs and traces through the GraphQL API while source code remains protected. When scoped to a single Worker, the permission limits data visibility exclusively to that resource. Cloudflare plans to maintain this separation as the system expands to other platform products. ## Secure CI/CD workflows CI/CD pipelines can now receive Editor role tokens scoped to individual Workers, preventing system-wide impact if compromised. This containment means misconfigured workflows can only deploy changes to their designated Worker, unable to delete it or affect other applications. The system also separates Worker deployment permissions from domain routing controls for additional security layers. ## Durable Objects permission inheritance Access to Durable Objects derives from their implementing Worker's permissions. Metadata read-only grants observability data without stored data access, while Editor role is required for direct data interaction. This inheritance model simplifies permission management while maintaining security boundaries. Cloudflare's approach ensures consistent permission structures across different resource types. ## Improved permission error messaging The platform now provides detailed error messages when users attempt unauthorized actions, specifying required permissions with API documentation links. This helps teams and agents understand exactly what access they need without resorting to broader permissions. The feature reduces troubleshooting time and promotes better permission hygiene across development workflows. ## Future platform-wide consistency Worker-level controls mark the first step toward unified authorization across Cloudflare's Developer Platform. The same role system will extend to KV namespaces, D1 databases and other resources, replacing account-wide permissions with resource-specific scoping. This evolution will provide consistent security while maintaining operational flexibility as the platform grows. ## Sources covering this story - https://blog.cloudflare.com/workers-granular-authorization/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._