But there is a release phase in Heroku, and reasonably that's the only time you should expect to need DDL permissions... The principle of least required privil

But there is a release phase in Heroku, and reasonably that's the only time you should expect to need DDL permissions... The principle of least required privilege seems to suggest that the production web server shouldn't have permission to perform DDL when it doesn't need it (so that fat-finger would have likely never happened, or never caused a problem, so long as it was only running in the context of the prod web service.) It's just a little bit surprising that there don't seem to be any concrete solutions for this, I find it hard to believe I'm the first to whine about this issue related to commonly understood DBA best-practices. I don't know how you solve it, (maybe add a production_migrations environment?)