Fine-Grained Access Control Now Available for All Heroku Customers

Fine-Grained Access Controls (FGAC) is now available to all Heroku customers. Heroku’s legacy system gave you predefined roles like admin, member, or collaborator, each with a fixed bundle of permissions. FGAC replaces that system with individual capability controls: deploy, scale dynos, view logs, manage config vars, promote through pipelines, provision add-ons, invite members, manage billing, and more.

Permissions work at multiple levels: organization-wide, team-specific, or scoped to individual apps. A user can read logs without being able to change config, or be granted access to one app, not an entire pipeline. Developers can have deploy access without giving them billing rights. Build the permission model your organization needs.

Why Fine-Grained Access Control matters for your team

Tighter security and compliance controls

Static permission models force organizations into an all-or-nothing trade-off between developer velocity and system security. Fine-Grained Access Control (FGAC) eliminates this friction by bringing Zero Trust Identity and Access Management (IAM) mechanics directly to Heroku resources. By scoping permissions to specific apps, pipelines, or actions, security teams can enforce precise guardrails without slowing down engineering workflows.

• Principle of least privilege: Scope capabilities, such as app:deploy, dynos:scale, or config:read, to individual environments. Grant users only the access they need, reducing security risk.
• Granular audit trails: Streamline security investigations with detailed, attribution-ready logging. Track exactly who modified environment variables, provisioned add-ons, or promoted code across pipeline stages.
• Compliance readiness: Simplify SOC 2 Type II, HIPAA, and ISO 27001 audit prep. Demonstrate separation of duties by proving that support engineers can read application logs without accessing sensitive production data or billing interfaces.

Greater team productivity

Managing user access shouldn’t rely on central IT ticket queues or administrative bottlenecks. FGAC lets you grant everyday app permissions without handing over admin keys, making it easier to onboard new team members and keep application delivery moving while maintaining strict security boundaries.

• Context-aware role assignment: Define permissions that match your team structure and responsibilities. Grant developers access to a single app within a pipeline while withholding access to company-wide add-ons and billing settings.
• Zero-friction team onboarding: Onboard new engineers in minutes by assigning predefined capability sets tied to specific team spaces or pipelines, eliminating manual permission provisioning.
• Self-service delegation: Empower team leads to assign privileges directly within their assigned environments, freeing admins from access request workflows.
• Explicit permission boundaries: Clear capability boundaries let everyone know what they can and cannot do.

How Fine-Grained Access Control works

FGAC integrates directly into existing Heroku interfaces, allowing you to manage permissions, automate access via scripts, or synchronize roles with external identity providers.

1. Heroku Dashboard

The Heroku Dashboard offers an intuitive interface for viewing and managing team access across organizations, pipelines, and individual apps. Admins can audit member capabilities at a glance and update roles with precision.

2. Heroku CLI

Manage permissions directly from your terminal using standard Heroku CLI commands. Command-line access allows platform teams to integrate permission updates into existing automation scripts and onboarding pipelines.

Note: Heroku CLI v11.10.0 or later is required, please update if you are on an earlier version.

# View assigned capabilities for a specific application
$ heroku access --app my-app
  email                       role            permissions
──────────────────────────────────────────────────────────────────────────────
  admin@company.com           admin           deploy, manage, operate, view
  existing-user@company.com   collaborator    operate, view

# Add a new team member to your app with operate and view permissions
$ heroku access:add user@company.com --app my-app --permissions operate,view
Adding user@company.com in application ⬢ my-app with operate,view permissions… done

# Update permissions of an existing team member on your app
$ heroku access:update existing-user@company.com --app my-app --permissions deploy,manage
Updating existing-user@company.com in application ⬢ my-app with deploy,manage permissions… done

3. Heroku Platform API

Build custom internal identity tools or integrate Heroku permission workflows into centralized identity providers (IdPs) like Okta, Microsoft Entra ID, or Ping Identity. The Platform API exposes endpoints to programmatically assign, update, and revoke capabilities across your entire Heroku footprint.

Getting started with Fine-Grained Access Control

If you’re already using Heroku, your existing permissions have been automatically migrated to the new FGAC model. You don’t need to do anything. Your team’s access continues to work exactly as before.

To start taking advantage of FGAC’s advanced features:

1. If using the Heroku CLI, check your version: Use heroku --version to verify you are on v11.10.0 or later.
2. Review your current permissions: Understand what access your team members have.
3. Identify opportunities to refine access: Look for cases where permissions can be more precise.
4. Update team member roles: Adjust access levels to match actual responsibilities.

To learn more, check out our Dev Center documentation. Have questions about FGAC? Contact Heroku Support.