Cloudflare has added a dashboard‑based invitation flow that lets you assign scoped permissions to individual Workers without leaving the UI. This change shortens the provisioning loop for engineers and security owners who need fine‑grained collaboration on edge code.
Inviting a Teammate from the Worker UI
Navigate to the target Worker, click the Invite button, and supply the colleague’s email address. A drop‑down lets you pick one of four predefined permission sets, then you confirm with a second Invite click. If the address already belongs to an account member, the new permissions take effect immediately; otherwise Cloudflare sends an account‑join invitation that, once accepted, activates the assigned scope.
Permission Sets and Their Boundaries
- Metadata Read‑Only: Allows viewing of settings, metrics, logs, and traces. No access to the Worker source or deployment actions.
- Content Read‑Only: Grants read‑only visibility into the Worker code, its configuration, and observability data. Editing or deploying is blocked.
- Editor: Enables code updates and deployments while preventing deletion of the Worker.
- Admin: Includes all Editor capabilities plus the right to delete the Worker.
Operational and Security Implications
Because the invitation flow is gated to the Super Administrator role, organizations retain a single point of control over who can distribute scoped access. The ability to limit a teammate to metadata or read‑only code reduces the blast radius of accidental changes and aligns with the principle of least privilege. However, the reliance on email‑based invitations introduces a dependency on timely acceptance; delays can stall onboarding or incident response.
From an operational standpoint, the UI‑driven model eliminates the need for separate API calls or external IAM tooling when granting per‑Worker rights, simplifying audit trails. Security teams should verify that Super Administrators are limited to trusted personnel and monitor invitation activity for unexpected patterns.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Adopt the dashboard invitation process for any new collaborator who only needs access to a subset of Workers. Map the four permission levels to your internal role matrix, and enforce that only Super Administrators perform invitations. Periodically review granted scopes to ensure they remain aligned with current responsibilities, and incorporate invitation logs into your compliance monitoring.
