micsapp PostHog Enterprise RBAC
Overview
Control access to PostHog analytics data, feature flags, and experiments using its organization and project-level permission model. PostHog has three hierarchy levels: Organization > Project > Resource.
Prerequisites
- PostHog Cloud or self-hosted with Enterprise license
- Organization admin role
- Multiple projects configured for environment separation (prod, staging)
Instructions
Step 1: Set Up Project-Level Access
set -euo pipefail
# Create separate projects for prod and staging environments
curl -X POST https://app.posthog.com/api/organizations/ORG_ID/projects/ \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
-d '{"name": "Production", "access_control": true}'
# Restrict team members to specific projects
curl -X POST https://app.posthog.com/api/projects/PROJECT_ID/members/ \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
-d '{"user_id": "USER_ID", "level": 1}'
# Levels: 1=Member, 8=Admin
Step 2: Configure Feature Flag Permissions
# Feature flag access matrix
feature_flags:
production_project:
who_can_create: [admin, senior_engineer]
who_can_edit: [admin, senior_engineer, engineer]
who_can_delete: [admin]
require_description: true
require_rollout_review: true # Two-person rule for >50% rollout
staging_project:
who_can_create: [admin, member]
who_can_edit: [admin, member]
who_can_delete: [admin, member]
Step 3: Set Up SSO (Enterprise Only)
In PostHog Organization Settings > Authentication:
- Enable SAML 2.0 with your IdP
- Set "Enforce SSO" to require all members to authenticate via IdP
- Map IdP groups to PostHog organization roles
- Configure automatic provisioning for new IdP users
Step 4: Create Scoped API Keys
set -euo pipefail
# Read-only key for the BI dashboard (no write access)
curl -X POST https://app.posthog.com/api/personal_api_keys/ \
-H "Authorization: Bearer $POSTHOG_ADMIN_KEY" \
-d '{"label": "bi-dashboard-readonly", "scopes": ["event:read", "insight:read", "dashboard:read"]}'
# Key for the feature flag service (flags only)
curl -X POST https://app.posthog.com/api/personal_api_keys/ \
-H "Authorization: Bearer $POSTHOG_ADMIN_KEY" \
-d '{"label": "feature-flag-service", "scopes": ["feature_flag:read", "feature_flag:write"]}'
Step 5: Audit Access and Changes
set -euo pipefail
# Query the activity log for permission changes
curl "https://app.posthog.com/api/projects/PROJECT_ID/activity_log/?scope=Organization" \
-H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" | \
jq '.results[] | select(.activity | contains("member")) | {user: .user.email, activity, created_at}'
Error Handling
| Issue | Cause | Solution |
|---|---|---|
403 on feature flag endpoint |
Key missing feature_flag scope |
Create key with appropriate scopes |
| Member can see prod data | Project access not restricted | Remove from prod project, add to staging only |
| SSO bypass possible | SSO not enforced | Enable "Enforce SSO" in org settings |
| Activity log gaps | Self-hosted log rotation | Increase retention in posthog-config |
Examples
Basic usage: Apply posthog enterprise rbac to a standard project setup with default configuration options.
Advanced scenario: Customize posthog enterprise rbac for production environments with multiple constraints and team-specific requirements.
Output
- Configuration files or code changes applied to the project
- Validation report confirming correct implementation
- Summary of changes made and their rationale
Resources
- Official PostHog documentation
- Community best practices and patterns
- Related skills in this plugin pack