Cloudflare has introduced Worker-level access controls that let account owners restrict access to a single Worker instead of the entire Developer Platform account, alongside four new roles: Metadata Read-Only, Content Read-Only, Editor, and Admin.
Metadata Read-Only exposes settings, logs, metrics, and traces without revealing source code — useful for debugging without exposing intellectual property. Content Read-Only allows reading a Worker's code without modifying it, suited to code-review agents. Editor permits read/write and settings changes but blocks deletion, matching CI/CD deployment needs. Admin grants full control, including deletion, but can still be scoped to one Worker rather than the whole account.
Each role can be applied at three scopes: across the entire Developer Platform, across one product (all Workers), or on a single named resource (one Worker). Cloudflare says the same role structure will extend to D1, R2, and KV in future updates, so a person or agent could eventually read data in one database without touching others.
The update also changes how Routes and Custom Domains are governed: modifying which hostname points to a Worker now requires both Editor access to that Worker and a separate Workers Routes permission for the zone, preventing a CI token from silently rerouting production traffic. Durable Objects inherit access from their parent Worker rather than having their own permission model. API error responses now link directly to documentation specifying which permission is missing, intended to help both humans and agents self-correct without requesting broader access.
Cloudflare is also retiring — without a deprecation date — a set of legacy Workers roles (such as "Workers Scripts Edit" and "Workers CI Edit") in favor of the new granular set, though existing tokens will keep working. The features are available now to all customers via the dashboard, API, or Terraform.
For companies that have started letting AI agents write, deploy, or debug production code, this is a concrete lever to enforce least privilege rather than relying on trust or manual review.
