Cloudflare Workers Granular Permissions: Lock Down CI and Agents

Cloudflare shipped per-Worker granular authorization on September 15, letting customers scope an API token or teammate access to a single named Worker with four distinct permission roles, with every account receiving the feature immediately and no plan upgrade required. The change replaces the prior model in which any Wrangler token covered every Worker on an account, a setup Cloudflare now frames as a security liability for CI/CD pipelines and AI coding agents.

Cloudflare shipped per-Worker granular authorization on September 15, and if you are running CI/CD pipelines or AI coding agents against Cloudflare Workers, it changes what you should be doing today. The new system lets you scope an API token or a teammate access to a single named Worker with four distinct permission roles. Every account gets it immediately, no plan upgrade required. The old model, where any Wrangler token covered every Worker on your account, is now a security liability with a straightforward fix available. Why the Old Model Was a Problem Before this change, giving a GitHub Actions workflow … The post