---
id: "nr-cloudflare-adds-per-worker-access-roles-for-teammates-and-724335"
slug: "cloudflare-adds-per-worker-access-roles-for-teammates-and-724335"
title: "Cloudflare adds per-Worker access roles for teammates and agents"
observed_at: "2026-09-18T13:36:42.507001+00:00"
record_date: "2026-09-18"
date_kind: "observed_at"
novelty: "new"
source_platform: "blog.cloudflare.com"
topics: ["security","coding-agents","developer-platforms"]
entities: ["Cloudflare","Cloudflare Workers"]
related_patterns: []
source_url: "https://blog.cloudflare.com/workers-granular-authorization"
source_urls: ["https://blog.cloudflare.com/workers-granular-authorization"]
basket: {"id":"0325e6b8-f527-4f9b-bfa3-3f30e57f380b","revision":1,"cluster_id":"724335cf-a728-47df-aa81-6b7d18174cab"}
type: "post"
description: "Cloudflare now lets a user or API token be scoped to a single Worker with one of four roles, from metadata read-only access to full admin control."
why_it_matters: "The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do."
verification_level: "source-inspected"
signal_type: "field_note"
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cloudflare-adds-per-worker-access-roles-for-teammates-and-724335"
retrieval_nugget: "Cloudflare now lets a user or API token be scoped to a single Worker with one of four roles, from metadata read-only access to full admin control. Cloudflare has added resource-level access controls to Workers, so a teammate or an API token can be restricted to one specific Worker instead of the whole account. Four new roles set the level:"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:9928cea78bb98b65972acc4b3e244c912d6053a6c80cf61a351cc0be0db1ce26","reviewed_at":"2026-09-24T13:28:46Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":1,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The change turns least privilege for coding agents from a policy aspiration into a concrete token configuration.","observed_facts":[{"text":"Cloudflare now lets a user or API token be scoped to one specific Worker.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]},{"text":"Four roles are available: Metadata Read-Only, Content Read-Only, Editor, and Admin.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]},{"text":"The Editor role can deploy changes to a Worker but cannot create or delete resources.","source_urls":["https://blog.cloudflare.com/workers-granular-authorization"]}],"mechanism":"It works because each role combines with one of three scopes, Developer Platform, product, or single resource, so a token can carry both a narrow action set and a narrow target set at the same time.","why_now":"This matters now because agents are increasingly handed API tokens to debug, review, and deploy production services on their own.","implications":["A practical implication is that teams can issue one token per agent task and keep observability access separate from source code access."],"evidence_boundary":"The announcement does not establish how these roles are audited in practice, how token management scales across many Workers, or when D1, R2, and KV will receive the same controls.","watch_conditions":["The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do."],"related_records":[],"new_branch_reason":"Resource-level authorization for Workers is a distinct access-control primitive for agent deployments and deserves a separate record from general platform news."}
routes: {"html":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335/","markdown":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335.md","json":"https://newruntime.com/posts/cloudflare-adds-per-worker-access-roles-for-teammates-and-724335.json"}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
---

# Cloudflare adds per-Worker access roles for teammates and agents

## Retrieval answer

Cloudflare now lets a user or API token be scoped to a single Worker with one of four roles, from metadata read-only access to full admin control. Cloudflare has added resource-level access controls to Workers, so a teammate or an API token can be restricted to one specific Worker instead of the whole account. Four new roles set the level:

Cloudflare has added resource-level access controls to Workers, so a teammate or an API token can be restricted to one specific Worker instead of the whole account. Four new roles set the level: Metadata Read-Only, Content Read-Only, Editor, which deploys but cannot create or delete resources, and Admin, which has full control. The roles are available to all customers today.

The change turns least privilege for coding agents from a policy aspiration into a concrete token configuration. It works because each role combines with one of three scopes, Developer Platform, product, or single resource, so a token can carry both a narrow action set and a narrow target set at the same time. A CI workflow holding an Editor token scoped to one Worker can deploy that Worker, but it cannot delete it or change any other application in the account.

This matters now because agents are increasingly handed API tokens to debug, review, and deploy production services on their own. A practical implication is that teams can issue one token per agent task and keep observability access separate from source code access. The announcement does not establish how these roles are audited in practice, how token management scales across many Workers, or when D1, R2, and KV will receive the same controls.

The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- topic hub: [Developer Platforms](https://newruntime.com/topics/developer-platforms.md): Explore the developer-platforms topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)