proomt

Search

Search posts, papers, and topics

All posts

HerokuAlberto Sigismondi3 min readrelease notesintermediate

Fine-Grained Access Control Now Available for All Heroku Customers

Read on heroku.com

Summary

Heroku replaces its static role model with per‑app fine‑grained permissions (view, deploy, operate, manage). The new model is exposed via the Dashboard, Heroku CLI (v11.10+), and Platform API, enabling teams to enforce least‑privilege, improve compliance, and automate access provisioning.

  • Roles are now app‑specific rather than organization‑wide, supporting least‑privilege and compliance (SOC 2, HIPAA, ISO 27001).
  • CLI commands (`heroku access`, `access:add`, `access:update`) let you list and modify permissions programmatically.
  • Platform API provides endpoints for external IdP integration (Okta, Entra ID, Ping).
  • Existing permissions are auto‑migrated; only version check (CLI v11.10+) is required to use new features.

Allows security teams to enforce precise guardrails without bottlenecking developers, and gives engineering leads self‑service control over who can view, deploy, or manage each app.

5/10
devopssecuritycloudiamplatform

Related reading

  3. Move and Scale Faster with FGA Permissions Index

    Auth0’s early‑access FGA Permissions Index pre‑computes all implied user/agent permissions on write, streams the flat index into the customer’s own database, and lets applications enforce permissions with a simple SQL join instead of runtime graph traversals. The feature targets enterprise B2B SaaS workloads with high‑cardinality relations and AI‑driven agents, promising constant‑time lookups and…

    Auth0auth0.com5 min

  4. Adding the Discord Updates YOU Want to See

    Discord’s latest update rolls out a batch of UI and moderation tweaks driven by community feedback: desktop DM pinning, channel pinning across all servers, audit‑log visibility for non‑members, a dedicated prune permission, role‑duplication shortcut, full‑size profile picture view, always‑visible search pagination, “Friends Since” timestamps, post‑send alt‑text & spoiler tags, bulk‑leave for inac…

    Discorddiscord.com4 min

  5. Preventing Destructive Actions with Step-up Authentication

    A step‑by‑step tutorial showing how to protect a high‑impact admin action (resetting all scores) in a Next.js app with Auth0 by combining role checks and a fresh MFA step‑up flow, including helper utilities, session claim preservation, and a hardened API endpoint.

    Auth0auth0.com14 min