Cloudflare has added resource-level access controls to Workers, so a teammate or an API token can be restricted to one specific Worker instead of the whole account. Four new roles set the level: Metadata Read-Only, Content Read-Only, Editor, which deploys but cannot create or delete resources, and Admin, which has full control. The roles are available to all customers today.
The change turns least privilege for coding agents from a policy aspiration into a concrete token configuration. It works because each role combines with one of three scopes, Developer Platform, product, or single resource, so a token can carry both a narrow action set and a narrow target set at the same time. A CI workflow holding an Editor token scoped to one Worker can deploy that Worker, but it cannot delete it or change any other application in the account.
This matters now because agents are increasingly handed API tokens to debug, review, and deploy production services on their own. A practical implication is that teams can issue one token per agent task and keep observability access separate from source code access. The announcement does not establish how these roles are audited in practice, how token management scales across many Workers, or when D1, R2, and KV will receive the same controls.
The next signal to watch is whether Cloudflare extends the same four roles to D1, R2, and KV, as it says it plans to do.