# Cloudflare Gateway gets granular roles for policies and lists!

Hi everyone, it's me, Shiichan! Today I've got a small but handy update about permissions. It's a quiet one, but if you run things as a team you'll be glad about it.

## What was announced?

Over on the Cloudflare Changelog, [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-policies/) firewall policies and [Zero Trust lists](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/) now support granular, resource-scoped roles. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.

## The story so far

Until now the roles were mostly account-level, so to let someone work on Gateway you often had to hand over pretty broad access. Narrow delegation like "only edit the DNS policies, please" was awkward.

## What changes

Now you can match access to the job: a network engineer can get write access to specific policies, security analysts can view all policies in read-only mode, and a list-management team can handle lists without touching policy configuration.

The nice part is that these work alongside your existing account-level roles. Members with legacy roles keep full access to all Gateway resources, so nothing breaks overnight.

## Dive Deep

Here are the roles that were added:

- Zero Trust Gateway Firewall Policies Admin (view and edit all firewall policies, including DNS, HTTP, and Network)
- Zero Trust Gateway DNS / HTTP / Network / Egress / Resolver Policies Admin (view and edit per type)
- Zero Trust Gateway Policies Admin / Read (edit / view all policies)
- Zero Trust Gateway Read Only (view all Gateway resources)
- Zero Trust DNS Locations Admin, Zero Trust Proxy Endpoints Admin
- Zero Trust Account Lists Admin / Read (edit / view all Gateway and Access lists)

To use them, just pick these roles when you [add a member](https://developers.cloudflare.com/fundamentals/manage-members/manage/) or create a permission policy. You can see the full list on the [resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) reference.

## Wrap-up

- Cloudflare Gateway policies and Zero Trust lists gained fine-grained, resource-scoped roles
- You can delegate least-privilege access by policy type or read-only
- They work alongside existing account-level roles, and legacy roles keep full access
- Great for teams running Zero Trust who want to tighten who can touch what!