Summary
On September 15, 2026, Cloudflare shipped per-Worker access control with four roles - Metadata Read-Only, Content Read-Only, Editor, and Admin - configurable in the dashboard, API, or Terraform. Teams can scope API tokens so an agent or CI/CD pipeline touches only specific Workers at the right permission level.
What changed
Cloudflare introduced individual and account-wide Worker permissions with four roles: Metadata Read-Only (settings, metrics, logs, traces), Content Read-Only (read code and observability), Editor (update and deploy, no delete), and Admin (Editor plus delete). Available to all customers.
Why it matters
As autonomous agents and CI pipelines gain deploy access, least-privilege scoping becomes a trust requirement. Cloudflare can now give a debugging agent read-only observability and a deploy pipeline Editor rights without delete power, reducing the blast radius of a compromised or misbehaving agent.
Evidence excerpt
Editor - Update and deploy a Worker without the ability to delete it.