Give every teammate and agent the right level of access to your Workers
Curated from Cloudflare Blog
Most platform engineering teams still struggle with the "fat token" problem. Developers often hold broad, long-lived credentials to deploy simple edge functions, creating a massive blast radius if those keys leak. This update shifts the paradigm from broad platform-wide access to granular, per-Worker permissions. It is particularly relevant now as autonomous agents and CI pipelines increasingly interact with production infrastructure. By decoupling access rights from general platform roles, you reduce the likelihood that a compromised deploy bot can inadvertently delete unrelated services. For practitioners, the immediate takeaway is to audit your existing CI/CD pipelines and replace broad account-level API keys with scoped, Worker-specific credentials to enforce the principle of least privilege in your edge deployments.
You can now scope access to individual Workers and assign narrower Developer Platform roles, so teammates, CI tokens, and agents get only the access they need to debug, deploy, or monitor safely.
— Cloudflare Blog