Because

prefect deploy

doesn’t just store metadata — it creates or updates a deployment that is allowed to launch flow runs. In Prefect Cloud’s permission model, that means the caller needs

run_flows

in addition to deployment-related permissions. In practice,

prefect deploy

does things like: - create or look up the flow - create/update the deployment - attach schedules/triggers - validate work pool / execution settings A deployment is effectively an instruction set for running a flow later, so Cloud treats deployment creation as something that requires flow-run permission too. So the short version is: -

create_deployments

alone is not enough -

run_flows

is also required because deployments enable execution If you're using a service account or API key for CI/CD, it generally needs a role/scope set equivalent to: -

create_deployments

-

run_flows

Often the easiest path is using a role like Developer rather than trying to make it narrower. If helpful, I can also break down the minimum Cloud role/scopes needed for

prefect deploy

in CI.

For

prefect deploy

in Prefect Cloud, the practical minimum is usually: -

run_flows

-

create_deployments

and/or

update_deployments

And depending on what your deployment command is doing, you may also need read access to related resources like: - work pools - variables - blocks - automations/triggers Why

run_flows

is needed A deployment is not just a static config object — it is a resource whose purpose is to create flow runs. So Cloud authorization typically requires permission to run flows, not just permission to edit deployment records. Common CI/CD scope set If your pipeline only needs to deploy/update existing infra, the token usually needs enough access to: - read flows - create/update deployments -

run_flows

- read work pools If your deployment process also creates related resources, add scopes for those too. Easy recommendation Instead of trying to handcraft the narrowest possible scope set, use a service account/API key with a role equivalent to Developer if that fits your org’s security model. That usually avoids surprising permission failures during

prefect deploy

. I also verified the CLI command exists in Prefect 3.x: -

prefect deploy --help

Helpful docs: - Deployments overview: docs.prefect.io/v3/deploy/index - CLI reference: docs.prefect.io/v3/api-ref/cli/deploy - Cloud RBAC / permissions: docs.prefect.io/v3/concepts/rbac If you want, I can give you a least-privilege example for: 1. CI that only deploys, or 2. CI that deploys and also manages work pools / schedules / automations.