---
id: "nr-agent-permissions-are-moving-closer-to-each-action-cd5676"
slug: "agent-permissions-are-moving-closer-to-each-action-cd5676"
type: "raw_signal"
title: "Agent permissions are moving closer to each action"
description: "Cloudflare can place company login in front of individual Workers or every Worker in an account."
observed_at: "2026-09-20"
record_date: "2026-09-20"
date_kind: "observed_at"
novelty: "notable"
source_platform: "newruntime.com"
topics: []
entities: []
related_patterns: []
source_url: "https://blog.cloudflare.com/workers-protected-by-access"
source_urls: ["https://blog.cloudflare.com/workers-protected-by-access","https://vercel.com/blog/the-end-of-credential-sprawl-for-agents","https://elevenlabs.io/blog/elevenlabs-mcp-in-claude","https://blog.cloudflare.com/wallets"]
why_it_matters: "Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits. Together, these approaches make access and authority specific to where an agent runs and what it is doing."
verification_level: "source-linked"
signal_type: "synthesis"
synthesis_of: [{"slug":"cloudflare-operator-update-access-ddos-eclipse-traffic-and-ct-monitoring","title":"Cloudflare puts Access in front of every Worker by default","url":"https://newruntime.com/posts/cloudflare-operator-update-access-ddos-eclipse-traffic-and-ct-monitoring/"},{"slug":"vercel-connect-gives-apps-and-agents-scoped-connectors","title":"Vercel Connect gives apps and agents scoped connectors","url":"https://newruntime.com/posts/vercel-connect-gives-apps-and-agents-scoped-connectors/"},{"slug":"elevenlabs-ships-hosted-mcp-in-claude","title":"ElevenLabs ships Hosted MCP in Claude","url":"https://newruntime.com/posts/elevenlabs-ships-hosted-mcp-in-claude/"},{"slug":"cloudflare-wallets-puts-programmable-money-next-to-edge-infrastructure","title":"Cloudflare Wallets Puts Programmable Money Next to Edge Infrastructure","url":"https://newruntime.com/posts/cloudflare-wallets-puts-programmable-money-next-to-edge-infrastructure/"}]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "signal:agent-permissions-are-moving-closer-to-each-action-cd5676"
retrieval_nugget: "Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits."
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676/","markdown":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676.md","json":"https://newruntime.com/signals/agent-permissions-are-moving-closer-to-each-action-cd5676.json"}
---

# Agent permissions are moving closer to each action

## Retrieval answer

Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits.

Cloudflare can place company login in front of individual Workers or every Worker in an account. Vercel Connect issues short-lived, task-scoped tokens, ElevenLabs uses OAuth with a deliberately scoped tool set, and Cloudflare Wallets bounds agent spending with allowances and transaction limits. Together, these approaches make access and authority specific to where an agent runs and what it is doing.

From the Field Notes:

- [Cloudflare puts Access in front of every Worker by default](https://newruntime.com/posts/cloudflare-operator-update-access-ddos-eclipse-traffic-and-ct-monitoring/) (2026-09-20)
- [Vercel Connect gives apps and agents scoped connectors](https://newruntime.com/posts/vercel-connect-gives-apps-and-agents-scoped-connectors/) (2026-09-19)
- [ElevenLabs ships Hosted MCP in Claude](https://newruntime.com/posts/elevenlabs-ships-hosted-mcp-in-claude/) (2026-09-18)
- [Cloudflare Wallets Puts Programmable Money Next to Edge Infrastructure](https://newruntime.com/posts/cloudflare-wallets-puts-programmable-money-next-to-edge-infrastructure/) (2026-09-18)

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Raw Signals](https://newruntime.com/signals.json): Open every source-linked raw signal.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)