Cloudflare Tunnel and Mesh: Scope Permissions Per Node at Last!

Hey everyone, it's Shii-chan! Today I found a Cloudflare update about access permissions, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On Cloudflare's Changelog, they announced granular permissions for Cloudflare Tunnel and Cloudflare Mesh.

Until now you could only hand out permissions across the whole account, but now you can scope access down to individual Tunnel instances and Mesh nodes. Administrators can delegate specific Tunnels or Mesh nodes to a member without granting account-wide control over private networking.

The story so far

Permissions used to live at the account level. Even if you only wanted to let someone read a Tunnel's logs, they ended up with reach over every Tunnel and Mesh node in the account. For handing a little bit of access to a support operator or a single app team, that was more power than you wanted to give.

What changes

When you add a member or create a permission policy, the resource picker now lists Tunnel instances and Mesh nodes as scopable resource types. For example:

• Give a support operator a read-only role on a single Tunnel instance for log streaming and diagnostics, without exposing other Tunnels or destructive actions.
• Give an application team a write role on a specific Mesh node, without access to the rest of your private network.
• Scope a single policy to one or many Tunnels and Mesh nodes at once.

Dive Deep

These granular permissions do not replace your existing account-level roles; they sit next to them as an additive layer.

• Existing account-level roles keep working. A member with Cloudflare Access or Cloudflare Zero Trust still has write access to every Tunnel and Mesh node in the account, so existing tokens and automation stay backward compatible.
• Permissions are additive. For an API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
• Resource enumeration is authorization-aware. Listing endpoints like GET /accounts/{id}/cfd_tunnel and GET /accounts/{id}/warp_connector return only the resources the principal can at least read.

Want more? Check the granular permissions for Cloudflare Tunnel guide, the Cloudflare One setup guide, and the resource-scoped roles reference.

Wrap-up

• You can now scope Cloudflare Tunnel and Cloudflare Mesh permissions per instance/node.
• Hand out read-only or write roles on specific resources only.
• Existing account-level roles keep working, thanks to the additive layer design.
• Listing APIs return only the resources you are allowed to see.

This one is a great fit for admins who want least-privilege private networking, and for anyone who needs to safely delegate access to support or app teams!