Capability
Permissions & Audit
Scoped access, and a record of every change. Ship to production without wondering who touched what — it's on the Team plan, not gated behind a sales call.
The problem with blanket access
On most small teams, everyone with a login can touch everything. A developer fixing a staging bug can also flip a flag in production — not because they meant to, but because nothing stopped them. There's no real line between a test change and something a customer sees.
And when something does go wrong, you're often left guessing. Who changed that flag? In which environment? At what time? Without an audit trail, the answer lives in Slack scrollback and people's memories — not in the product.
Scoped permissions
Grant access at the account, project, or individual environment level. A developer working on a staging flag does not automatically inherit write access to production. Delegation is explicit, minimal, and reversible.
Account scope
Org-wide roles and access defaults. Controls who can create projects and manage billing-level settings.
Project scope
Access per feature-flag project. Developers scoped to a project cannot touch other projects or environments.
Environment scope
Permission per environment within a project. A staging write role does not carry into production.
Granularity is the default, not a bolt-on. Access follows the shape of how teams actually work — by project and environment — not by a flat all-or-nothing permission bit.
Production-sensitive controls
Specific operations on production environments — flag enables, rollout changes, environment variable writes — can be restricted to a defined set of roles. Least-privilege is enforced at the point of change, not via policy documentation. Production protection is not a manual review gate that slows every release. It is a targeted control around the specific operations that carry real customer risk.
-
Flag enable restrictions
Limit who can enable or disable flags in production environments to named roles.
-
Rollout change controls
Restrict who can adjust rollout percentages in production, so a number does not get bumped by accident.
-
Environment variable writes
Protect environment-level configuration from changes by developers without production scope.
-
Role-based assignments
Map team members to roles that carry the right level of access for their actual responsibilities.
-
Explicit delegation
Access is granted on purpose and can be revoked in a couple clicks — no offboarding process required.
-
Zero friction for developers
The right people already have the access they need, so most day-to-day work does not wait on an approval.
Immutable audit history
Every flag change, config write, and permission change gets logged — who did it, when, and in which environment. The log can't be edited or deleted after the fact. When something breaks, you already have the answer: no digging through logs, no asking around, no guessing who touched what.
Actor identity
Every entry includes who made the change — not just a service account.
Environment context
Entries are scoped to the environment where the change occurred.
Tamper-proof record
Entries cannot be altered or deleted after the fact.
What teams gain
-
A bad flag change stays contained, because access is scoped instead of all-or-nothing.
-
When something breaks, you can reconstruct exactly what happened without digging through Slack or asking who remembers.
-
When a customer or procurement asks "who has access to what, and can you prove it," you already have the answer — no spreadsheet required.
-
Developers aren't slowed down by any of this — the right people already have the access they need, so routine work doesn't wait on an approval.
Related capabilities
-
Feature Flags
Manage flag state with access controls that enforce who can change what in production
-
Progressive Rollouts
Control rollout exposure with percentage ramps — every change tracked in the audit log
Developers
For developers
The setup guide walks through configuring scoped grants step by step. For the model behind them - roles, grants, teams, and what gets retained in the audit trail - see the concept pages.
Release with confidence, not guesswork
Scoped permissions and an audit trail, included on the Team plan — not an enterprise add-on, not a sales call.