{"id":"nr-cloudflare-adds-per-worker-access-roles-for-teammates-and-724335","slug":"cloudflare-adds-per-worker-access-roles-for-teammates-and-724335","title":"Cloudflare adds per-Worker access roles for teammates and agents","observed_at":"2026-09-18T13:36:42.507001+00:00","record_date":"2026-09-18","date_kind":"observed_at","novelty":"new","source_platform":"blog.cloudflare.com","topics":["security","coding-agents","developer-platforms"],"entities":["Cloudflare","Cloudflare Workers"],"related_patterns":[],"source_url":"https://blog.cloudflare.com/workers-granular-authorization","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"],"basket":{"id":"0325e6b8-f527-4f9b-bfa3-3f30e57f380b","revision":1,"cluster_id":"724335cf-a728-47df-aa81-6b7d18174cab"},"type":"post","description":"Cloudflare now lets a user or API token be scoped to a single Worker with one of four roles, from metadata read-only access to full admin control.","why_it_matters":"The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do.","verification_level":"source-inspected","signal_type":"field_note","schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:cloudflare-adds-per-worker-access-roles-for-teammates-and-724335","retrieval_nugget":"Cloudflare now lets a user or API token be scoped to a single Worker with one of four roles, from metadata read-only access to full admin control. Cloudflare has added resource-level access controls to Workers, so a teammate or an API token can be restricted to one specific Worker instead of the whole account. Four new roles set the level:","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:9928cea78bb98b65972acc4b3e244c912d6053a6c80cf61a351cc0be0db1ce26","reviewed_at":"2026-09-24T13:28:46Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The change turns least privilege for coding agents from a policy aspiration into a concrete token configuration.","observed_facts":[{"text":"Cloudflare now lets a user or API token be scoped to one specific Worker.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]},{"text":"Four roles are available: Metadata Read-Only, Content Read-Only, Editor, and Admin.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]},{"text":"The Editor role can deploy changes to a Worker but cannot create or delete resources.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]}],"mechanism":"It works because each role combines with one of three scopes, Developer Platform, product, or single resource, so a token can carry both a narrow action set and a narrow target set at the same time.","why_now":"This matters now because agents are increasingly handed API tokens to debug, review, and deploy production services on their own.","implications":["A practical implication is that teams can issue one token per agent task and keep observability access separate from source code access."],"evidence_boundary":"The announcement does not establish how these roles are audited in practice, how token management scales across many Workers, or when D1, R2, and KV will receive the same controls.","watch_conditions":["The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do."],"related_records":[],"new_branch_reason":"Resource-level authorization for Workers is a distinct access-control primitive for agent deployments and deserves a separate record from general platform news."},"routes":{"html":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335/","markdown":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335.md","json":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335.json"},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"next_reads":[{"type":"topic","path":"/topics/security/","url":"https://newruntime.com/topics/security/","title":"Security","reason":"Explore the security topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/security.md","json_url":"https://newruntime.com/topics/security.json"},{"type":"topic","path":"/topics/coding-agents/","url":"https://newruntime.com/topics/coding-agents/","title":"Coding Agents","reason":"Explore the coding-agents topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/coding-agents.md","json_url":"https://newruntime.com/topics/coding-agents.json"},{"type":"topic","path":"/topics/developer-platforms/","url":"https://newruntime.com/topics/developer-platforms/","title":"Developer Platforms","reason":"Explore the developer-platforms topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/developer-platforms.md","json_url":"https://newruntime.com/topics/developer-platforms.json"},{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}