posthog-enterprise-rbac

# PostHog Enterprise RBAC ## Overview PostHog access control uses a three-level hierarchy: Organization > Project > Resource. Organizations contain multiple projects (e.g., production, staging), and each project has its own data, feature flags, and dashboards. Members are assigned roles at the organization level and can be restricted to specific projects. ## Prerequisites - PostHog Cloud or self-hosted with enterprise license - Organization admin role - Multiple projects configured (one per environment) ## Access Control Model | Level | Scope | Controls | |-------|-------|----------| | Organization | All projects | Member management, billing, SSO enforcement | | Project | Single project | Feature flags, insights, dashboards, session recordings | | API Key | Scoped operations | Personal API key with specific scopes | **Member Roles:** | Role | Level | Permissions | |------|-------|------------| | Owner | 15 | Full admin, billing, delete org | | Admin | 8 | Manage members, all project settings | | Member | 1 | View/create insights, flags, recordings | ## Instructions ### Step 1: Set Up Project-Level Access ```bash set -euo pipefail # Create a production project with access control curl -X POST "https://app.posthog.com/api/organizations/$ORG_ID/projects/" \ -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "Production", "access_control": true}' # Add a member to a specific project (level 1 = Member, 8 = Ad...