An enterprise architect needs to ensure that developer access to production dynos and config vars is restricted and logged. What Heroku Enterprise capabilities are used to enforce this?