Using App Permissions in Heroku Organizations

Last updated 12 April 2016

Organization accounts allow you to manage access to a shared group of applications across your team. With app permissions, you can apply more granular permissions to users on a per-app basis, and more efficiently manage your application development and delivery process.

Overview

Multiple users working on multiple apps with the same level of permissions introduces management challenges. App permissions give you fine grained access controls to:

• Guard and monitor changes to production apps
• Restrict what changes can be made to an app
• Manage the types of resources that users have access to

Roles

Users can be added to an organization in the Organization’s Access page.

Organization users can be assigned one of two roles: admin or member. An organization can have any number of users in each role. For more information on adding users to your organization and assigning roles see Managing an Organization account

App permissions

Each user’s access and permissions to an app is managed on the app’s Access page:

All org members are by default assigned the view permission on apps in the org. This allows them to:

• See basic information about the app
• View the Access tab of an app, which displays app members and their respective permissions
• View application activity including builds and releases
• See dynos and information about an app’s processes

Additionally, any combination of the following permissions may be assigned to members on a per-app basis: manage, deploy and operate. Org admins always have all permissions on all apps in the organization.

The deploy permission gives a user access to the application’s code and allows them to:

• Fetch code
• Push code
• View and edit config vars
• Add and remove free add-ons
• Run one-off dynos
• Rollback releases

The operate permission allows users to work on the operational aspects of an application’s availability and resource consumption. Users with this permission can:

• View and edit config vars
• Add and remove free and paid add-ons
• Manage add-on configurations
• Restart the app
• Rollback releases
• Manage process scaling and stacks

The manage permission enables a user to control access to the application:

• Add users to the app
• Assign or edit permissions for any user on the app
• Restrict access to the app
• Rename or delete the app
• Transfer the app
• Manage custom domains

For a handy reference of all the actions that are enabled by a permission, see the App Permissions and Allowed Actions article.

Adding apps to the organization

When any member of the organization creates or transfers an app into the org, they automatically get all permissions on that app. Because this includes the manage permission, the user can then add other members to the app and assign them any combination of permissions that is appropriate.

Once an app is created or moved into an organization, only org admins or users with the manage permission on the app can delete it or transfer it out of the organization.

Collaborating on an app

Members in an organization can see all apps and access them in read-only mode. They can be added to specific apps by users who have manage permissions on those apps. In the Dashboard, this is done via the app’s Access tab, where a user can be added, and permissions assigned. Access and permissions can also be revoked here.

CLI support is performed by the heroku access commands and are documented here.