diff --git a/internal/tests/cli/boundary/_workers.bash b/internal/tests/cli/boundary/_workers.bash
new file mode 100644
index 0000000000..99020db7f5
--- /dev/null
+++ b/internal/tests/cli/boundary/_workers.bash
@@ -0,0 +1,40 @@
+load _authorized_actions
+
+function read_worker() {
+  boundary workers read -id $1 -format json
+}
+
+function create_worker() {
+  boundary workers create controller-led \
+    -name $1 \
+    -description 'test worker'
+}
+
+function update_worker() {
+  boundary workers update -id $1 -name $2 -version 0
+}
+
+function delete_worker() {
+  boundary workers delete -id $1
+}
+
+function list_workers() {
+  boundary workers list -format json
+}
+
+function worker_id() {
+  local id=$1
+  strip $(list_workers | jq -c ".items[] | select(.name | contains(\"$id\")) | .[\"id\"]")
+}
+
+function has_default_worker_actions() {
+  local out=$1
+  local actions=('read' 'update' 'delete' 'add-worker-tags' 'set-worker-tags' 'remove-worker-tags')
+
+  for action in ${actions[@]}; do
+    $(has_authorized_action "$out" "$action") || {
+      echo "failed to find $action action in output: $out"
+      return 1 
+    } 
+  done
+}
diff --git a/internal/tests/cli/boundary/workers.bats b/internal/tests/cli/boundary/workers.bats
new file mode 100644
index 0000000000..daafcd6092
--- /dev/null
+++ b/internal/tests/cli/boundary/workers.bats
@@ -0,0 +1,68 @@
+#!/usr/bin/env bats
+
+load _auth
+load _workers
+load _helpers
+
+export NEW_WORKER='test'
+
+export NEW_UPDATED_WORKER='newtest'
+
+@test "boundary/login: can login as default user" {
+  run login $DEFAULT_LOGIN
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: can create $NEW_WORKER worker" {
+  run create_worker $NEW_WORKER
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: can not create already created $NEW_WORKER worker" {
+  run create_worker $NEW_WORKER
+  echo "$output"
+  [ "$status" -eq 1 ]
+}
+
+@test "boundary/workers: can read $NEW_WORKER worker" {
+  local wid=$(worker_id $NEW_WORKER)
+  run read_worker $wid
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: can list workers" {
+  run list_workers
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: the worker contains default authorized-actions" {
+  local wid=$(worker_id)
+  local out=$(read_worker $wid)
+  run has_default_worker_actions "$out"
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: can update worker's name" {
+  local wid=$(worker_id $NEW_WORKER)
+  run update_worker $wid $NEW_UPDATED_WORKER
+  echo "$output"
+  [ "$status" -eq 0 ]
+}
+
+@test "boundary/workers: can delete $NEW_UPDATED_WORKER worker once" {
+  local wid=$(worker_id $NEW_UPDATED_WORKER)
+  run delete_worker $wid
+  echo "$output"
+  run has_status_code "$output" "204"
+  [ "$status" -eq 0 ]
+
+  run delete_worker $wid
+  echo "$output"
+  run has_status_code "$output" "404"
+  [ "$status" -eq 0 ]
+}