Secure all your internal vibe-coded applications — in one click
15:00 · August 14, 2026 · Cloudflare AI Blog
Introducing Cloudflare Access for Workers. Attach an Access policy directly to a Worker and it applies everywhere that Worker runs — routes, custom domains, workers.dev, and previews — automatically.
Summary
Cloudflare has introduced Access for Workers, a capability that lets security teams attach authentication policies directly to individual serverless functions or enforce them account-wide. The change responds to the rapid growth of employee-built applications created with AI assistance, which often reach the public internet without oversight and risk exposing internal data. Instead of configuring protections at the hostname level, administrators can now bind policies to the Worker itself, ensuring that every route, custom domain, workers.dev subdomain, or preview URL requires authentication before any request reaches application code.
Policies can be applied at three levels of precedence: hostname-specific rules first, then Worker-level settings, and finally account defaults. An account-level policy can mark every existing and future Worker as private from the moment of creation, with options to cover only preview traffic, production traffic, or both. Individual Workers can still be exempted when public access is intentional. When Access is active, the authenticated user’s identity—email, name, and groups—is attached to the request context object as ctx.access, allowing code to retrieve details via ctx.access.getIdentity() without manual JWT validation. The same mechanism works in local development through wrangler dev by supplying a simulated identity in the configuration file.
For organizations running Workers for Platforms, a single policy on the dispatch Worker automatically protects every application deployed through a namespace. The underlying implementation relies on Cloudflare’s new FL2 Rust-based modular proxy, which separates routing logic from execution and allows Access checks to occur before Worker invocation regardless of how traffic arrives. The result is a default-private posture for internal applications that integrates with existing identity providers or service tokens while reducing reliance on individual developers to remember security steps.
Why it matters
This update is highly relevant for security professionals managing the risks of AI-accelerated development, often referred to as 'vibe-coding'. It provides an actionable, scalable way for Dutch enterprises using Cloudflare to enforce zero-trust access on serverless applications, preventing accidental data exposure from rapidly deployed internal tools.
