Tighter Access Control for Enterprise Domains
Cloudflare has introduced Domain Scoped Roles in Early Access, giving enterprise account owners finer control over which users can access which domains. The feature addresses a common operational need: restricting production domain changes to a small set of team members while leaving development and pre-production domains accessible to the broader team.
The new capability works alongside Domain Groups, which let account owners assign users to collections of domains rather than configuring access domain-by-domain. When domains are added to or removed from a group, the access of all users associated with that group updates automatically, removing a recurring administrative chore.
Setting Up Domain Scoped Roles
Enterprise customers must contact their Customer Success Manager to be enrolled in the beta. Only users with Super Administrator privileges can modify account memberships. Once enabled, the setup flow begins on the account members page in the Cloudflare dashboard.
- Navigate to the members page for your account.
- Invite a new member or edit an existing user's permissions.
- Specify three items: the users to invite, the resource scope, and the roles to assign.
When choosing the resource scope, selecting "All Domains" exposes the legacy roles for assignment. For more targeted access, you can build an explicit inclusion or exclusion list of domains per user. Before the invite is sent, the interface displays a confirmation summary of the users, scope, and selected roles.
Managing Access Through Domain Groups
Domain Groups are created either from the member invite flow or under Account Configurations → Lists. When setting up a group, the account owner picks the domains to include. The group can then be referenced during any subsequent member invitation, and any changes to the group's domain membership propagate instantly to every user holding that group.
Under the Hood: The Bach Permission System
Domain Scoped Roles is the first visible result of Bach, a policy-based authorization system for the Cloudflare control plane. Bach has been running API Tokens, and it is now becoming the authorization backbone for all Cloudflare services. The system allows permissions to be attached to specific resource sets — such as zones, accounts, or even individual DNS records — instead of the broad, account-wide grants typical of the previous RBAC model.
The legacy approach mapped roles like 'Super Administrator' or 'DNS' to flat permissions such as workers:read or zones:edit. The API Gateway checked whether an actor had the matching permission for the requested endpoint. This model had two significant limits: permissions could not be constrained to specific resources, and for each resource type there were only simple read/edit variants, with "edit" covering both modification and deletion.
In Bach, policies express explicit granular actions. A DNS role policy, for example, lists separate create, read, update, delete, and list actions under a resource path like com.cloudflare.api.account.zone.dns-record. The scope section of the policy identifies the account, with a wildcard "objects" value indicating the permissions apply across all objects in that account.
When the same user's access is narrowed to a single production zone, the policy changes in two meaningful ways. First, the number of granted permissions drops sharply — account-level resources that support dashboard navigation, such as account.read, subscriptions.read, and subscriptions.list, remain, but other account-level products like Workers or Zero Trust no longer appear. Second, the scope section names a specific zone identifier (com.cloudflare.api.account.zone.b1fbb152bbde3bd28919a7f4bdca841f), meaning the defined permissions are valid only for that exact domain. Any request to modify DNS on any other zone is rejected.
Rollout and Next Steps
The Early Access release requires a formal request: enterprise customers should contact their CSM to have Domain Scoped Roles enabled on their account. This deployment is described as a significant step in the ongoing migration of all authorization traffic to Bach, which will later broaden the same granular scoping to additional products and services across the Cloudflare platform.
