Short answer: Yes—if you’re on Prefect Cloud Enterprise. Otherwise, per-deployment restrictions aren’t available. Details: - Prefect Cloud 3.x supports two layers of access control: - Workspace-level RBAC (Pro & Enterprise): roles like Viewer, Runner, Developer apply to all deployments in a workspace. - Object-level ACLs (Enterprise only): per-deployment (and per-work pool/block) access lists so only specified users/teams/service accounts can view or run a given deployment. How it works (Enterprise): - Open a deployment in the UI → “Manage access” → add specific users/teams/service accounts and grant view/run/edit/delete as needed. - Tip: Put ACLs on a work pool to cascade access rules to all deployments using that pool. Important limitations: - Flows and flow runs are still visible to all users in a workspace even if a related deployment is restricted. - ACLs apply to deployments, work pools, and blocks (not flows). If you’re not on Enterprise (workarounds): - Create separate workspaces per team/project and invite users only to the workspaces they should access. - Use service accounts with scoped workspace roles (e.g., Runner) for CI/CD or controlled execution. - Note these are isolation/operational patterns, not true per-deployment permissions. Docs: - Object-level ACLs (per-deployment): Access control lists (ACLs) - Workspace roles (RBAC): Manage roles - Service accounts: Service accounts - Teams (Enterprise): Manage teams - Workspaces: Workspaces Quick clarification to help me tailor guidance: - Are you using Prefect Cloud or open-source Prefect Server? - Which plan are you on (Free/Pro/Enterprise)? - Do you want to restrict just “run” permissions, or also viewing/editing for certain deployments?