Cloudflare Introduces Resource-Level Access Control and Four New Roles for Workers

Cloudflare has introduced resource-level access control and four new roles for Workers to strengthen permission management for team members and AI agents. This update is designed to prevent production incidents caused by unnecessary permissions and to apply the principle of least privilege, and is available to all customers immediately.

Four New Roles and Their Scope

The new role system is defined by access level as follows:

• Metadata Read-Only: Allows access to configuration and observability data for debugging while blocking source code exposure.
• Content Read-Only: Allows viewing code but prohibits modification or deployment.
• Editor: Allows deployment but prohibits resource deletion, making it suitable for CI/CD workflows.
• Admin: Provides the highest level of administrative privileges, including resource deletion.

Access scope is segmented into three levels: Developer Platform, Product, and Resource, allowing permissions to be granted to individual Workers or specific resources only.

Scalability and Future Plans

While currently applied to Workers, the same roles and resource-level access control will be extended to other Developer Platform products such as D1, R2, and KV in the future. This will allow access permissions to be restricted to specific databases or buckets instead of the entire account. Additionally, when an access-denied error occurs due to narrow permission settings, improved error messages specifying the required permissions will be provided to facilitate debugging.