Give every teammate and agent the right level of access to your Workers

If you are letting an agent deploy Workers, an account-wide API token is the wrong blast radius. Cloudflare shipped four Developer Platform roles - Metadata Read-Only, Content Read-Only, Editor and Admin - scoped to the whole platform, all Workers, or one individual Worker. Editor can deploy and change settings but cannot create or delete resources, which is exactly the shape a CI token should have. Available now, legacy roles keep working.