CLOUDFLARE has introduced worker-level access controls for its Workers platform, allowing organisations to restrict a person, CI/CD system or AI agent to a specific Worker rather than granting access across an entire account.
Available immediately to all customers, the controls provide four roles: Metadata Read-Only for settings, metrics, logs and traces; Content Read-Only for viewing Worker code; Editor for deploying changes and updating settings without creating, renaming or deleting resources; and Admin for full control over the selected Worker.
The permissions can be assigned to dashboard users or issued through narrowly scoped API tokens, with configuration available through the Cloudflare dashboard, API or Terraform. Cloudflare says the controls are intended to support least-privilege workflows, such as allowing debugging without exposing source code, code review without deployment rights, or CI/CD deployments without permission to delete the application or access other resources.
Routes and Custom Domains require both Editor access to the Worker and Workers Routes permission for the relevant zone. Durable Objects inherit permissions from their associated Worker; accessing stored data through Data Studio requires Editor access.
Cloudflare says the roles can be applied at Developer Platform, product or individual-resource level, and are planned for D1, R2 and KV. Existing legacy permissions remain supported with no announced deprecation date, although the company recommends migrating to the new roles. API errors for unauthorised operations now include links to documentation identifying the permissions required.