Cloudflare Ships Granular Authz and Four RBAC Roles for Workers

On September 15, Cloudflare officially launched granular authorization and RBAC for the Workers developer platform. Developers can now grant a teammate or an AI agent access to a single Worker or even a Durable Object without opening up the whole account. A day earlier, Cloudflare staffer @dinasaur404 had jokingly teased "RBAC launching tomorrow" at a Charli xcx concert — and it came true.

Confirmed

• Authorization granularity goes down to a single Worker and Durable Objects, leaving other account resources untouched — well suited to scoping permissions for agents.
• Four new roles debut, including Metadata Read-Only (monitoring logs only, no source code), Content Read-Only (code and database contents), and Editor (can deploy without full control).
• Cloudflare calls this one of the most requested features and plans to extend granular authz across the whole developer platform, including D1 and KV.

Why it matters

• As teams and AI agents increasingly operate cloud resources, account-level all-or-nothing permissions carry too much risk; per-app, per-role authorization sharply reduces mistakes and privilege escalation.
• The Editor role lets outside collaborators or agents deploy without touching sensitive configuration, paving the way for agent-driven development workflows.

2026-09-15 ~ 2026-09-15 · 6 related posts

• [source] Cloudflare adds granular authz to Workers with four roles for teammates and agents — dinasaur_404 · 2026-09-15
• [source] Cloudflare ships granular authz for Workers, its most requested feature — dinasaur_404 · 2026-09-15
• Cloudflare adds per-Worker access scoping and four granular roles for agents and teammates — dinasaur_404 · 2026-09-15
• Cloudflare to launch RBAC for Workers tomorrow, engineer teases — dinasaur_404 · 2026-09-15

2 near-duplicate retellings: dinasaur_404 · dinasaur_404