Cloudflare lets CI and agents access one Worker at a time

Cloudflare now lets teams scope a user or API token to one Worker, with separate roles for inspecting logs, reading code, deploying changes or full administration. A deployment pipeline can update its own application without permission to delete it or touch other Workers. The controls are available to all customers through the dashboard, API and Terraform.

Cloudflare · Sep 15, 2026

Why it matters

Useful when a deployment pipeline or debugging agent currently has broader account access than its job requires.

More context

Try an Editor token on a noncritical Worker first. Changing routes or custom domains also requires Workers Routes permission for the zone; deploying without changing those connections does not. This September 15 release covers Worker-level access, with other resource types planned.

Keep in mind

Vendor documentation, not a permissions audit by 1min. Editor access can still deploy harmful code. Resource-level controls for D1, R2 and KV should not be assumed available from this announcement.

Original read