Give every teammate and agent the right level of access to your Workers

Cloudflare has introduced resource-level access controls for Workers, allowing customers to grant users, agents, and API tokens permissions limited to a specific Worker rather than an entire account. Four roles—Metadata Read-Only, Content Read-Only, Editor, and Admin—provide graduated access for observing application data, reviewing code, deploying changes without deletion rights, or fully managing a Worker. Permissions can be applied across Developer Platform, product, or individual resource scopes, supporting least-privilege access for debugging, code review, CI/CD deployments, and administration. Routes and Custom Domains additionally require Workers Routes permission for the relevant zone, while Durable Objects inherit access from their associated Worker. Cloudflare’s APIs now provide documentation links in authorization errors to clarify needed permissions, and controls can be configured through the dashboard, API, or Terraform, including through user groups. Existing legacy Workers permissions remain supported without a planned deprecation date, though Cloudflare recommends migrating to the new roles and plans to extend the same model to products such as D1, R2, KV, and other Developer Platform resources.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.