proomt

Search

Search posts, papers, and topics

All posts

CloudflareDina Kozlov8 min readintermediate

Give every teammate and agent the right level of access to your Workers

Read on cloudflare.comHN 1·0 comments

Summary

Cloudflare adds four granular roles (Metadata Read‑Only, Content Read‑Only, Editor, Admin) that can be scoped to a single Worker (or other Developer Platform resources). The roles let you enforce least‑privilege for teammates, CI/CD agents, or third‑party services, and can be granted via the dashboard or scoped API tokens.

  • Roles are scoped at three levels – platform, product, or individual resource – letting you limit access to exactly one Worker.
  • Metadata Read‑Only: view settings, metrics, logs, traces; no code access.
  • Content Read‑Only: read Worker code or D1 data; no write capability.
  • Editor: read/write code and settings; cannot create or delete the Worker.

Fine‑grained, resource‑level permissions let large teams and automated agents follow the principle of least privilege, reducing blast‑radius of credential leaks or mis‑configurations while still supporting typical workflows (debugging, code review, CI deployment).

5/10
devopsapi designsecurityaccess control

Related reading

  1. Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC

    Cloudflare’s Agent Development Lifecycle (ADLC) replaces the classic SDLC with an autonomous, event‑driven workflow system that lets AI agents handle code generation, testing, deployment, and maintenance. The platform builds on Cloudflare Workflows and the new @cloudflare/ci library to spin up containers, run headless browsers, and chain steps with caching and credential support. Observability is…

    InfoQinfoq.com2 min

  2. Cloudflare/Security-Audit-Skill

    Cloudflare open‑sources a “security‑audit” skill that turns an LLM‑enabled coding agent into a structured vulnerability auditor. It runs six deterministic phases, validates findings against a JSON schema, and supports additive runs to improve coverage.

    Hacker News front pagegithub.com3 minreleaseHN20938

  3. Cloudflare Quick Tunnels

    Cloudflare Quick Tunnels let you expose a local service via an outbound‑only connection to Cloudflare’s edge network. The service gets a public URL (anycast across 335+ cities) with automatic TLS, DDoS protection, and no inbound ports. It’s positioned for short‑lived agents, webhooks, and testing loops, with JSON health output and no config files.

    Hacker News front pagecloudflare.com1 minreleaseHN831316

  4. Fine-Grained Access Control Now Available for All Heroku Customers

    Heroku replaces its static role model with per‑app fine‑grained permissions (view, deploy, operate, manage). The new model is exposed via the Dashboard, Heroku CLI (v11.10+), and Platform API, enabling teams to enforce least‑privilege, improve compliance, and automate access provisioning.

    Herokuheroku.com3 minrelease

  5. Introducing Filestore agent volumes: fully managed storage for agent workspaces

    Google Cloud adds Filestore agent volumes, a fully‑managed, elastic file‑system that automatically provisions isolated POSIX workspaces for GKE‑based AI agent sandboxes. Volumes attach in milliseconds, support RWX with file‑level locking, and charge only for used capacity with automatic tiering, aiming to cut cold‑start latency and storage waste for large‑scale agent fleets.

    Google Cloud Bloggoogle.com4 min

  6. Introducing the DevOps Agent Kit

    The DevOps Agent Kit is an Apache‑2.0 open‑source starter kit that lets you plug an LLM‑based coding assistant into your existing CI/CD, security, and feature‑flag tooling via CloudBees Unify. It ships with seven read‑only example skills, enforces RBAC and audit trails, and normalises data from up to 63 tools so the agent can answer a single “are we good to ship?” question with verifiable evidenc…

    Codeshipcloudbees.com5 min