Cloudflare Workers Access Now Comes in Four Roles!

Hey everyone, it's Shii-chan! Today's news makes access control for Cloudflare Workers much more precise. Let's take a look!

Cloudflare Changelog developers.cloudflare.com

What was announced?

This comes from the Cloudflare Changelog. You can now grant access to specific Workers, choosing from four roles to control exactly how much access teammates, agents, and CI/CD workflows get.

• Metadata Read-Only — view settings, metrics, logs, and traces, with no access to Worker code and no ability to make changes
• Content Read-Only — read Worker code, settings, and observability data, without the ability to modify or deploy
• Editor — update and deploy a Worker, without the ability to delete it
• Admin — everything Editor can do, plus the ability to delete the Worker

The story so far

Until now, Worker access couldn't be scoped this finely. Letting someone touch a Worker sometimes meant handing over more access than they actually needed.

What changes

Here's how the new roles can play out in practice.

• Give a debugging agent Metadata Read-Only so it can inspect settings and observability data only
• Give a code review agent Content Read-Only so it can read code without changing it
• Give a CI/CD workflow Editor so it can deploy without deleting the Worker or touching others
• Give a trusted teammate or agent Admin for full control, including deletion

You can apply these roles across every product on the Developer Platform, across all Workers, or to an individual Worker. As more of the "hands" touching your Workers belong to agents and automated workflows rather than just people, being able to draw these fine lines — view-only versus edit-but-don't-delete — is a genuinely useful improvement.

Dive Deep

Durable Objects don't have their own roles or scopes — they simply inherit whatever permissions are assigned to the Worker that implements them. You can configure all of this through the Cloudflare dashboard, the API, or Terraform, so it slots into existing IaC workflows too. Worker-level access controls are available to all customers starting today.

Wrap-up

• You can now grant access to specific Workers, choosing from four roles: Metadata Read-Only, Content Read-Only, Editor, and Admin
• Scope access differently for debugging agents, code review agents, CI/CD, and trusted teammates
• Durable Objects inherit permissions from their implementing Worker
• Configurable via dashboard, API, or Terraform, available to all customers today

A quietly powerful update if you ever let teammates, agents, or CI/CD touch your Workers!