Cloudflare Lets Teams Lock Worker Access to Individual Apps

Cloudflare has introduced Worker-level access controls for all customers, allowing organisations to limit a person, CI/CD system or AI agent to a specific Worker rather than granting access across an entire account.

Four roles are available: Metadata Read-Only, which exposes settings and observability data such as metrics, logs and traces without source code; Content Read-Only, which permits code access but no changes; Editor, which allows content and settings changes but not resource creation or deletion; and Admin, which provides full control over the selected Worker, including deletion and granting access to others.

The controls can be assigned to dashboard users or API tokens and configured through Cloudflare’s dashboard, API or Terraform. An Editor token scoped to one Worker can deploy changes while being unable to alter other applications or delete the target Worker. Routes and Custom Domains require both Editor access to the Worker and the relevant Workers Routes permission for the zone.

Durable Objects inherit permissions from the Worker that implements them; Metadata Read-Only covers their observability data, while Data Studio access requires Editor privileges. Cloudflare also says its APIs now provide documentation links in relevant 403 responses to identify missing permissions.

Existing legacy Workers permissions will continue to work, with no deprecation date announced, although Cloudflare recommends moving to the new roles. The company plans to extend resource-level controls to D1, R2 and KV. Teams can configure access under **Manage Account > Members**, or use user groups to apply policies to multiple people.