---
title: "Give every teammate and agent the right level of access to your Workers"
description: "Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV."
---

# Give every teammate and agent the right level of access to your Workers

[Cloudflare](https://yomu.fyi/company/cloudflare) · Dina Kozlov · Sep 15, 2026

**Type:** Announcement

## Summary

Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.

## Context

The change addresses least-privilege access for teammates, agents, and automation operating on Cloudflare Workers. Broad roles can expose source code, permit unintended changes, or affect unrelated resources, while overly granular permissions can be difficult to manage.

## Approach / What changed

The access model combines four roles with three scopes: Developer Platform, product, or individual resource. Users can receive scoped dashboard access, while agents and CI/CD workflows can use API tokens restricted to a specific Worker. Worker Editor plus Workers Routes permission is required to manage routes or Custom Domains, and Worker permissions also determine access to Durable Objects.

## Takeaways

- Metadata Read-Only provides settings, metrics, logs, traces, and other observability data without exposing Worker source code.
- An Editor-scoped API token can deploy changes to one Worker but cannot delete it or modify other applications, containing the impact of a misconfiguration or exposed token.
- Changing a Worker’s route or Custom Domain requires both Editor access to that Worker and Workers Routes permission for the zone.

## FAQ

### How can an agent inspect a Worker without reading its source code?

Give the agent Metadata Read-Only access scoped to the Worker. It can inspect settings, metrics, logs, traces, and other observability data through Cloudflare APIs, but cannot access the Worker’s source code.

### What access should a CI/CD workflow use to deploy one Worker safely?

Use an API token with the Editor role scoped to that Worker. The workflow can deploy changes, but it cannot delete the Worker or modify other applications in the account.

### Why does managing a route require more than Worker access?

Adding, changing, or removing a route or Custom Domain can redirect production traffic or take an application offline. It therefore requires Editor access to the Worker and Workers Routes permission for the zone, rather than broader access to unrelated domain settings.

**Tags:** [API](https://yomu.fyi/topic/api), [CI/CD](https://yomu.fyi/topic/ci-cd), [Security](https://yomu.fyi/topic/security), [Workers](https://yomu.fyi/topic/workers)

- Source: [Cloudflare](https://blog.cloudflare.com/workers-granular-authorization)
- Source URL: https://blog.cloudflare.com/workers-granular-authorization
- Ingested by Yomu: 2026-09-15T16:01:26.141Z

[Read original post](https://blog.cloudflare.com/workers-granular-authorization)