[Secrets Store] Clarify role, API token, and scope permissions

[mitch292]

• Describe the three independent permission layers (user roles, API token permissions, secret scopes) and the fact that all three must be satisfied for actions like deploying a Worker with a Secrets Store binding.
• Clarify that Account Secrets Store Read only allows viewing metadata, and that Account Secrets Store Edit is required to bind a secret to another Cloudflare resource (Workers, AI Gateway).
• Add a CI/CD caution callout reproducing the error message users hit when their wrangler-action token only has Read permission (Secrets store bindings unavailable in github action workers-sdk#8964).
• Add a Secret scopes section documenting the workers and ai-gateway scopes and how to set them via dashboard, API, or Wrangler.

Summary

Attempt to clarify the proper API token permissions required for deploying a secret and the additional level of per service authorization required on the secret scopes.

Screenshots (optional)

Overview change

API Token permission clarifications

Secret scope clarifications

Documentation checklist

• The change adheres to the documentation style guide.

[cloudflare-docs-bot]

Review

⚠️ 1 warning, 💡 3 suggestions found in commit ca0a8df. ⚠️ Part of the review could not complete and will retry on the next push.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

❌ This review could not complete this run; results may be incomplete. It will retry on the next push.

Style Guide Review

Warnings (1)

File	Issue
secrets-store/access-control.mdx line 20	Numbered list used for non-sequential items — Ordered list enumerates two independent concepts, Authorization and Secret scope, rather than a sequence of steps. Fix: Use a bulleted list for these unordered permission layers.

Suggestions (3)

File	Issue
secrets-store/access-control.mdx line 54	Bullet list with fewer than three items — Two-item bullet list describes Read and Edit permission levels. Fix: Consider rewriting the two permission levels as prose.
secrets-store/access-control.mdx line 67	Bullet list with fewer than three items — Two-item bullet list lists the supported scopes (workers and ai-gateway). Fix: Consider rewriting the two scopes as prose.
secrets-store/access-control.mdx line 72	Bullet list with fewer than three items — Two-item bullet list states the two deployment requirements. Fix: Consider rewriting the two requirements as prose.

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.