Gateway, Cloudflare One, Cloudflare Fundamentals - New permissions and roles for Gateway policies and lists

<p>You can now assign granular, resource-scoped roles for <a href="https://developers.cloudflare.com/cloudflare-one/traffic-policies/">Cloudflare Gateway</a> firewall policies and <a href="https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/">Zero Trust lists</a>. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="what-is-new">What is new</h4><a class="anchor-link" href="#what-is-new"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>When you <a href="https://developers.cloudflare.com/fundamentals/manage-members/manage/">add a member</a> or create a <a href="https://developers.cloudflare.com/fundamentals/manage-members/policies/">permission policy</a>, the following resource-scoped roles are now available:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Role</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Zero Trust Gateway Firewall Policies Admin</td> <td>Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies.</td> </tr> <tr> <td>Zero Trust Gateway DNS Policies Admin</td> <td>Can view and edit Gateway DNS policies.</td> </tr> <tr> <td>Zero Trust Gateway HTTP Policies Admin</td> <td>Can view and edit Gateway HTTP policies.</td> </tr> <tr> <td>Zero Trust Gateway Network Policies Admin</td> <td>Can view and edit Gateway Network policies.</td> </tr> <tr> <td>Zero Trust Gateway Egress Policies Admin</td> <td>Can view and edit Gateway Egress policies.</td> </tr> <tr> <td>Zero Trust Gateway Resolver Policies Admin</td> <td>Can view and edit Gateway Resolver policies.</td> </tr> <tr> <td>Zero Trust Gateway Policies Admin</td> <td>Can view and edit all Gateway policies.</td> </tr> <tr> <td>Zero Trust Gateway Policies Read</td> <td>Can view all Gateway policies.</td> </tr> <tr> <td>Zero Trust Gateway Read Only</td> <td>Can view all Gateway resources.</td> </tr> <tr> <td>Zero Trust DNS Locations Admin</td> <td>Can view and edit DNS locations.</td> </tr> <tr> <td>Zero Trust Proxy Endpoints Admin</td> <td>Can view and edit Gateway Proxy Endpoints.</td> </tr> <tr> <td>Zero Trust Account Lists Admin</td> <td>Can view and edit all Gateway and Access lists.</td> </tr> <tr> <td>Zero Trust Account Lists Read</td> <td>Can view all Gateway and Access lists.</td> </tr> </tbody> </table></div> <p>These roles allow you to:</p> <ul> <li>Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.</li> <li>Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.</li> <li>Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.</li> </ul> <p>You can also now assign <em>Resource-scoped roles</em>. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. <strong>Existing account-level roles continue to work.</strong> A member with the <code>Cloudflare Gateway</code> or <code>Cloudflare Zero Trust</code> role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="get-started">Get started</h4><a class="anchor-link" href="#get-started"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <ul> <li>Review the <a href="https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles">resource-scoped roles</a> on the Cloudflare role reference.</li> <li>Learn how to <a href="https://developers.cloudflare.com/fundamentals/manage-members/policies/">create permission policies</a> that use these roles.</li> </ul>