Wrangler currently has two auth modes: OAuth, full user permissions and static tokens that are manually created in the dashboard. Neither is designed for the pattern where a human operator and one or more AI agents need different permission boundaries.
I'd like the ability to create scoped, short-lived tokens from the CLI itself. There's an open GitHub issue (13042) for this.
But, there needs to be a twist: Tokens should be sociable not just by resource type, but by specific resource ID and action.