--- title: "Fine-Grained Access Control Now Available for All Heroku Customers" url: https://daily.dev/posts/fine-grained-access-control-now-available-for-all-heroku-customers-896bb7jwc source_url: https://www.heroku.com/blog/fine-grained-access-control-now-available-all-customers type: article source: "Heroku" published: 2026-08-21T17:26:52.611Z updated: 2026-08-21T17:38:03.374Z tags: ["compliance", "platform-engineering", "heroku", "iam"] reading_time: 4 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fine-Grained Access Control Now Available for All Heroku Customers **[Heroku](https://daily.dev/sources/heroku)** · 4 min read · 1 upvotes · 0 comments ## Summary Heroku has rolled out Fine-Grained Access Control (FGAC) to all customers, replacing the old fixed roles (admin, member, collaborator) with individual capability-based permissions such as deploy, scale dynos, view logs, or manage billing. Permissions can be scoped at the organization, team, or app level, supporting least-privilege security, detailed audit trails, and easier SOC 2, HIPAA, and ISO 27001 compliance. FGAC can be managed via the Heroku Dashboard, CLI (v11.10.0+), or Platform API, and existing permissions have been automatically migrated with no action required from current users. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Heroku CLI version do I need to use Fine-Grained Access Control? Heroku CLI version 11.10.0 or later is required to manage Fine-Grained Access Control from the terminal. You can check your version with heroku --version and update if you're on an earlier release. Once updated, commands like heroku access, heroku access:add, and heroku access:update let you assign granular permissions such as deploy, manage, operate, and view to specific apps. _Teams rolling out permission changes on Heroku can track CLI and platform updates like this on daily.dev._ ### How does Heroku's Fine-Grained Access Control differ from its old permission system? Fine-Grained Access Control replaces Heroku's legacy fixed roles (admin, member, collaborator) with individual capability controls like deploy, scale dynos, view logs, manage config vars, promote through pipelines, provision add-ons, invite members, and manage billing. Permissions can be scoped at the organization, team, or individual app level, so a user can read logs without changing config or get deploy access without billing rights. _Engineers designing least-privilege access policies can follow platform security changes like this on daily.dev._ ### Do I need to migrate my existing Heroku permissions to use Fine-Grained Access Control? No manual migration is needed. Existing Heroku permissions were automatically migrated to the new FGAC model, and team access continues to work exactly as before. To take advantage of the new granular controls, teams should check their CLI version, review current permissions, and update roles to match actual responsibilities. _Platform admins planning access reviews can keep tabs on rollouts like this via daily.dev._ ## Similar posts on daily.dev - [Expanded Role-Based Access Control \(RBAC\) for Enterprise teams](https://daily.dev/posts/expanded-role-based-access-control-rbac-for-enterprise-teams-knjcacyhr) · Vercel · 23 upvotes · 0 comments - [Scale Enterprise Teams Securely with Roles for Auth0 FGA](https://daily.dev/posts/scale-enterprise-teams-securely-with-roles-for-auth0-fga-0mjuzqn6r) · Auth0 · 0 upvotes · 0 comments --- Tags: [#compliance](https://daily.dev/tags/compliance), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#heroku](https://daily.dev/tags/heroku), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/fine-grained-access-control-now-available-for-all-heroku-customers-896bb7jwc)