Cloudflare introduced per-Worker access controls on September 15, allowing a teammate or coding agent to work on one application without gaining the same permissions across the account.
The new roles distinguish several jobs. Metadata Read-Only exposes settings and observability information without product content. Content Read-Only permits inspection of Worker code without edits. Editor allows content and settings changes but cannot create or delete resources; Admin includes broader management of the assigned resource.
For an agent asked to fix an application, the distinction can prevent a credential from also granting control over unrelated Workers. A separate read-only token can support investigation without authorizing the agent to change the code it is inspecting.
Cloudflare says the roles are available to all customers and can be assigned to users or scoped API tokens. They still need to be chosen deliberately: an Admin token for one Worker gives more authority over that application than a debugging or editing task usually requires.