A compute server of a distributed cloud computing network receives a request for an object that is to be handled by an object worker, where the object worker includes a single instantiation of a piece of code that solely controls reading/writing to the object. The object worker is instantiated at the compute server. The compute server enforces an access policy to determine whether the request is allowed to be processed by the object worker. If the request is allowed to be processed by the object worker, the object worker processes the request. If the request is not allowed to be processed by the object worker, the request is blocked.