Secure all your internal vibe-coded applications — in one click

This post introduces the ability to apply Cloudflare Access policies directly to Cloudflare Workers, either at the account level or on individual Workers. This allows for all internal applications hosted on Workers to be private by default, simplifying security for internal developer platforms and individual applications. Key features include account-level policies for all Workers (preview and production), individual Worker policies, and the ability to bypass the account-wide policy for specific Workers. It also introduces the ability to access authenticated user identity (email, name, groups) directly within the Worker's context object (`ctx.access.getIdentity()`), eliminating the need for manual JWT validation. Local testing is supported via `wrangler.jsonc` configuration. The underlying implementation leverages the new Rust-based modular proxy (FL2) to split Workers routing from execution, allowing Access policies to be enforced earlier in the request pipeline.