Heroku has rolled out Fine-Grained Access Control (FGAC) to all customers, replacing the old fixed roles (admin, member, collaborator) with individual capability-based permissions such as deploy, scale dynos, view logs, or manage billing. Permissions can be scoped at the organization, team, or app level, supporting least-privilege security, detailed audit trails, and easier SOC 2, HIPAA, and ISO 27001 compliance. FGAC can be managed via the Heroku Dashboard, CLI (v11.10.0+), or Platform API, and existing permissions have been automatically migrated with no action required from current users.
Table of contents
Why Fine-Grained Access Control matters for your teamHow Fine-Grained Access Control worksGetting started with Fine-Grained Access ControlQuestions this post answers
What Heroku CLI version do I need to use Fine-Grained Access Control?
Heroku CLI version 11.10.0 or later is required to manage Fine-Grained Access Control from the terminal. You can check your version with heroku --version and update if you're on an earlier release. Once updated, commands like heroku access, heroku access:add, and heroku access:update let you assign granular permissions such as deploy, manage, operate, and view to specific apps. Teams rolling out permission changes on Heroku can track CLI and platform updates like this on daily.dev.
How does Heroku's Fine-Grained Access Control differ from its old permission system?
Fine-Grained Access Control replaces Heroku's legacy fixed roles (admin, member, collaborator) with individual capability controls like deploy, scale dynos, view logs, manage config vars, promote through pipelines, provision add-ons, invite members, and manage billing. Permissions can be scoped at the organization, team, or individual app level, so a user can read logs without changing config or get deploy access without billing rights. Engineers designing least-privilege access policies can follow platform security changes like this on daily.dev.
Do I need to migrate my existing Heroku permissions to use Fine-Grained Access Control?
No manual migration is needed. Existing Heroku permissions were automatically migrated to the new FGAC model, and team access continues to work exactly as before. To take advantage of the new granular controls, teams should check their CLI version, review current permissions, and update roles to match actual responsibilities. Platform admins planning access reviews can keep tabs on rollouts like this via daily.dev.