{"id":"nr-agent-permissions-are-moving-closer-to-each-action-cd5676","slug":"agent-permissions-are-moving-closer-to-each-action-cd5676","type":"raw_signal","title":"Agent permissions are moving closer to each action","description":"Cloudflare can place company login in front of individual Workers or every Worker in an account.","observed_at":"2026-09-20","record_date":"2026-09-20","date_kind":"observed_at","novelty":"notable","source_platform":"newruntime.com","topics":[],"entities":[],"related_patterns":[],"source_url":"https://blog.cloudflare.com/workers-protected-by-access","source_urls":["https://blog.cloudflare.com/workers-protected-by-access","https://vercel.com/blog/the-end-of-credential-sprawl-for-agents","https://elevenlabs.io/blog/elevenlabs-mcp-in-claude","https://blog.cloudflare.com/wallets"],"why_it_matters":"Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits. Together, these approaches make access and authority specific to where an agent runs and what it is doing.","verification_level":"source-linked","signal_type":"synthesis","synthesis_of":[{"slug":"cloudflare-operator-update-access-ddos-eclipse-traffic-and-ct-monitoring","title":"Cloudflare puts Access in front of every Worker by default","url":"https://newruntime.com/posts/cloudflare-operator-update-access-ddos-eclipse-traffic-and-ct-monitoring/"},{"slug":"vercel-connect-gives-apps-and-agents-scoped-connectors","title":"Vercel Connect gives apps and agents scoped connectors","url":"https://newruntime.com/posts/vercel-connect-gives-apps-and-agents-scoped-connectors/"},{"slug":"elevenlabs-ships-hosted-mcp-in-claude","title":"ElevenLabs ships Hosted MCP in Claude","url":"https://newruntime.com/posts/elevenlabs-ships-hosted-mcp-in-claude/"},{"slug":"cloudflare-wallets-puts-programmable-money-next-to-edge-infrastructure","title":"Cloudflare Wallets Puts Programmable Money Next to Edge Infrastructure","url":"https://newruntime.com/posts/cloudflare-wallets-puts-programmable-money-next-to-edge-infrastructure/"}],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"signal:agent-permissions-are-moving-closer-to-each-action-cd5676","retrieval_nugget":"Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits.","status":"published","visuals":[],"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676/","markdown":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676.md","json":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676.json"},"next_reads":[{"type":"collection","path":"/signals/","url":"https://newruntime.com/signals/","title":"Raw Signals","reason":"Open every source-linked raw signal.","media_type":"text/html","json_url":"https://newruntime.com/signals.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}