posthog-enterprise-rbac

name	posthog-enterprise-rbac
description	PostHog enterprise access control: organization/project hierarchy, member roles, scoped API keys, SSO/SAML configuration, and activity audit logging. Trigger: "posthog SSO", "posthog RBAC", "posthog enterprise", "posthog roles", "posthog permissions", "posthog SAML", "posthog access".
allowed-tools	Read, Write, Edit
version	1.12.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","posthog","rbac"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

PostHog Enterprise RBAC

Overview

PostHog access control uses a three-level hierarchy: Organization > Project > Resource. Organizations contain multiple projects (e.g., production, staging), and each project has its own data, feature flags, and dashboards. Members are assigned roles at the organization level and can be restricted to specific projects.

Prerequisites

• PostHog Cloud or self-hosted with enterprise license
• Organization admin role
• Multiple projects configured (one per environment)

Access Control Model

Level	Scope	Controls
Organization	All projects	Member management, billing, SSO enforcement
Project	Single project	Feature flags, insights, dashboards, session recordings
API Key	Scoped operations	Personal API key with specific scopes

Member Roles:

Role	Level	Permissions
Owner	15	Full admin, billing, delete org
Admin	8	Manage members, all project settings
Member	1	View/create insights, flags, recordings

Instructions

Step 1: Set Up Project-Level Access

set -euo pipefail
# Create a production project with access control
curl -X POST "https://app.posthog.com/api/organizations/$ORG_ID/projects/" \
  -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Production", "access_control": true}'

# Add a member to a specific project (level 1 = Member, 8 = Admin)
curl -X POST "https://app.posthog.com/api/projects/$PROD_PROJECT_ID/members/" \
  -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
  -H  \
  -d 


curl  \
  -H  | \
  jq