Cloudflare adds per-Worker access roles so AI agents get least-privilege permissions

Cloudflare adds fine-grained permissions for Workers

Cloudflare has rolled out resource-level authorization for Workers, allowing account owners to grant a teammate, CI pipeline or AI agent access to one specific application without exposing anything else in the account. According to the Cloudflare blog, the feature is available to all customers starting today.

The company frames the change around the shift in who and what builds on its Developer Platform. As agents increasingly deploy and debug applications, broad account-wide credentials become a liability: an agent with more access than it needs can make unintended changes in production. Scoping permissions to a single Worker is intended to contain that blast radius.

Four new roles

The update introduces four roles that can be applied per resource:

• Metadata Read-Only: view resource lists, settings and observability data such as metrics, logs and traces, without access to the underlying product content. Suited to debugging without exposing source code.
• Content Read-Only: read product content, such as Worker code or D1 database content, without the ability to modify or deploy it. Suited to code review.
• Editor: read and write content and update settings, but cannot create or delete resources. Suited to deployments by people, agents or CI/CD systems.
• Admin: full control over the resource, including renaming, deleting and granting access, while still being scoped to a single Worker.

Cloudflare says it deliberately landed on four tiers rather than either extreme. Roles that are too broad force administrators to over-grant and undermine least privilege, while a long list of individual permissions makes it hard to know which ones to hand out. The four roles map to the practical levels of trust: debug without seeing content, read without changing, change without deleting, and full management.

Scopes, users and API tokens

Each role can be applied at one of three scopes: the entire Developer Platform, a single product such as all Workers, or a single resource such as one Worker. Access can be assigned to a user, who then sees only the Worker they were granted when logging into the dashboard, or baked into an API token with the same scoping, which is the intended path for agents.

Cloudflare walks through several workflows where this matters. An agent scoped to one Worker can query analytics through the GraphQL API and inspect logs and traces, but those requests return data only for Workers it can access, and it never sees source code. A code review agent can read a Worker's code without being able to deploy changes. A CI/CD pipeline can hold an Editor token scoped to one Worker, so a leaked or misconfigured token can still deploy but cannot delete the application or touch other Workers in the account.

Routes and Durable Objects follow the Worker

Two edge cases get special handling. Routes and Custom Domains, which determine which hostnames reach a Worker, can redirect or break production traffic if changed, so modifying them requires both Editor access to the Worker and Workers Routes permission for the zone, rather than broad zone access. Once a route is configured, new versions of the Worker can be deployed without any access to the zone, as long as the deployment does not alter that connection, meaning a CI system can ship code without also holding domain, database or storage permissions.

Durable Objects carry no roles of their own; access derives from the Worker that implements them. Metadata Read-Only exposes a Durable Object's metrics, logs and traces but not its stored data, which requires the Editor role because Durable Objects Data Studio can query and modify that data directly.

Better errors for humans and agents

Narrow permissions inevitably lead to denied operations. Instead of returning a bare 403 Forbidden, Cloudflare's APIs now point to the documentation that spells out exactly which permission the operation requires, so both engineers and agents can figure out what is missing and request it.

The company also plans to extend the same role model to other Developer Platform products, including D1, R2 and KV, and says the separation between metadata and content will carry over, for example letting someone inspect a database's settings without reading its rows.

Why it matters

Least privilege has always been security hygiene, but AI agents make it operationally urgent: an autonomous system with account-wide credentials can act on far more than a sleepy human ever would. Cloudflare's move turns access control into something sized for agents and pipelines, not just people, and the per-resource API token pattern is a template other platforms are likely to copy. The improved 403 responses are a small but telling detail, since agents that can read what permission they lack can often self-correct instead of failing silently.