diff options
Diffstat (limited to 'etc/authzd/spice.schema')
| -rw-r--r-- | etc/authzd/spice.schema | 2124 |
1 files changed, 2111 insertions, 13 deletions
diff --git a/etc/authzd/spice.schema b/etc/authzd/spice.schema index 0f3494f7..24d8c050 100644 --- a/etc/authzd/spice.schema +++ b/etc/authzd/spice.schema @@ -1,27 +1,2125 @@ -definition user {} +// Comprehensive GitLab SpiceDB Schema +// Based on systematic analysis of 798 GitLab permissions from 487+ policy files +// Includes all permissions from app/policies and ee/app/policies +// Full support for CI_JOB_TOKEN permissions and Custom Roles -definition project { +definition organization { + relation admin: user + relation member: user + relation owner: user + + // Core permissions + permission read = member + admin + owner + permission admin_organization = admin + owner + permission create_group = member + admin + owner + permission admin_compliance_framework = admin + owner + permission admin_external_audit_events = admin + owner + + // Additional organization permissions + permission create_organization = admin + owner + permission admin_instance_external_audit_events = admin + owner + permission read_organization = member + admin + owner + permission read_all_organization_resources = admin + owner + permission admin_service_accounts = admin + owner + permission create_service_account = admin + owner + permission delete_service_account = admin + owner + permission admin_organization_cluster_agent_mapping = admin + owner + permission read_organization_cluster_agent_mapping = member + admin + owner + permission read_organization_user = member + admin + owner + permission update_organization_user = admin + owner + permission remove_user = admin + owner + permission delete_user = admin + owner + permission admin_add_on_purchase = admin + owner + permission manage_destroy = admin + owner +} + +definition group { + relation developer: user + relation group_bot: user relation guest: user + relation maintainer: user + relation organization: organization + relation owner: user + relation parent_group: group relation planner: user relation reporter: user + relation service_account: user + + // Core access permissions + permission read = guest + reporter + developer + maintainer + owner + organization->member + parent_group->read + permission read_group = guest + reporter + developer + maintainer + owner + organization->member + parent_group->read + permission guest_access = guest + reporter + developer + maintainer + owner + permission reporter_access = reporter + developer + maintainer + owner + permission developer_access = developer + maintainer + owner + permission maintainer_access = maintainer + owner + permission owner_access = owner + permission planner_access = planner + reporter + developer + maintainer + owner + permission project_bot_access = group_bot + + // Administrative permissions + permission admin_group = owner + organization->admin_organization + permission admin_group_member = maintainer + owner + permission admin_compliance_framework = owner + organization->admin_compliance_framework + permission admin_epic = reporter + developer + maintainer + owner + permission admin_cicd_variables = maintainer + owner + permission admin_runner = owner + permission admin_vulnerability = developer + maintainer + owner + permission archive_group = owner + permission remove_group = owner + permission change_visibility_level = owner + + // Wiki permissions + permission create_wiki = developer + maintainer + owner + permission admin_wiki = maintainer + owner + permission read_wiki = guest + reporter + developer + maintainer + owner + permission download_wiki_code = reporter + developer + maintainer + owner + + // Milestone and iteration permissions + permission admin_milestone = reporter + developer + maintainer + owner + permission read_milestone = guest + reporter + developer + maintainer + owner + permission create_milestone = reporter + developer + maintainer + owner + permission admin_iteration = reporter + developer + maintainer + owner + permission read_iteration = guest + reporter + developer + maintainer + owner + permission create_iteration = developer + maintainer + owner + permission admin_iteration_cadence = developer + maintainer + owner + permission read_iteration_cadence = guest + reporter + developer + maintainer + owner + permission create_iteration_cadence = developer + maintainer + owner + + // Label permissions + permission admin_label = reporter + developer + maintainer + owner + permission read_label = guest + reporter + developer + maintainer + owner + permission read_group_labels = guest + reporter + developer + maintainer + owner + + // Issue board permissions + permission admin_issue_board = reporter + developer + maintainer + owner + permission read_issue_board = guest + reporter + developer + maintainer + owner + permission admin_issue_board_list = reporter + developer + maintainer + owner + permission read_issue_board_list = guest + reporter + developer + maintainer + owner + + // Epic board permissions (EE) + permission admin_epic_board = reporter + developer + maintainer + owner + permission read_epic_board = guest + reporter + developer + maintainer + owner + permission admin_epic_board_list = reporter + developer + maintainer + owner + permission read_epic_board_list = guest + reporter + developer + maintainer + owner + + // Package and container permissions + permission admin_package = maintainer + owner + permission read_package = guest + reporter + developer + maintainer + owner + permission create_package = developer + maintainer + owner + permission destroy_package = maintainer + owner + permission read_container_image = guest + reporter + developer + maintainer + owner + + // Security permissions + permission read_security_dashboard = reporter + developer + maintainer + owner + permission read_group_security_dashboard = reporter + developer + maintainer + owner + permission access_security_and_compliance = developer + maintainer + owner + permission admin_vulnerability = developer + maintainer + owner + permission read_vulnerability = reporter + developer + maintainer + owner + permission resolve_vulnerability_with_ai = developer + maintainer + owner + + // Analytics permissions + permission read_group_analytics_dashboards = reporter + developer + maintainer + owner + permission view_productivity_analytics = reporter + developer + maintainer + owner + permission read_group_activity_analytics = reporter + developer + maintainer + owner + permission read_group_contribution_analytics = reporter + developer + maintainer + owner + permission read_group_repository_analytics = reporter + developer + maintainer + owner + permission view_group_devops_adoption = reporter + developer + maintainer + owner + permission view_group_ci_cd_analytics = reporter + developer + maintainer + owner + permission read_ci_cd_analytics = reporter + developer + maintainer + owner + permission read_group_build_report_results = reporter + developer + maintainer + owner + permission read_group_coverage_reports = reporter + developer + maintainer + owner + + // Compliance permissions + permission read_compliance_dashboard = reporter + developer + maintainer + owner + permission admin_compliance_pipeline_configuration = owner + permission read_compliance_adherence_report = developer + maintainer + owner + permission read_compliance_violations_report = developer + maintainer + owner + permission read_group_audit_events = owner + + // Member management + permission admin_member_access_request = maintainer + owner + permission read_member_access_request = guest + reporter + developer + maintainer + owner + permission invite_group_members = maintainer + owner + permission override_group_member = owner + permission activate_group_member = maintainer + owner + permission ban_group_member = owner + permission destroy_group_member = owner + permission update_group_member = maintainer + owner + + // Service account permissions + permission admin_service_account_member = owner + permission create_service_account = owner + permission delete_service_account = owner + + // Runner permissions + permission register_group_runners = maintainer + owner + permission admin_group_or_admin_runner = owner + permission read_group_runners = reporter + developer + maintainer + owner + permission read_group_all_available_runners = reporter + developer + maintainer + owner + + // CRM permissions (EE) + permission admin_crm_contact = reporter + developer + maintainer + owner + permission read_crm_contact = guest + reporter + developer + maintainer + owner + permission admin_crm_organization = reporter + developer + maintainer + owner + permission read_crm_organization = guest + reporter + developer + maintainer + owner + + // Custom field permissions (EE) + permission admin_custom_field = owner + permission read_custom_field = guest + reporter + developer + maintainer + owner + + // Deploy token permissions + permission create_deploy_token = maintainer + owner + permission read_deploy_token = maintainer + owner + permission destroy_deploy_token = maintainer + owner + permission manage_deploy_tokens = maintainer + owner + permission update_group_deploy_key = maintainer + owner + permission update_group_deploy_key_for_group = maintainer + owner + + // Dependency proxy permissions + permission admin_dependency_proxy = owner + permission read_dependency_proxy = guest + reporter + developer + maintainer + owner + + // AI/Duo permissions + permission access_duo_features = developer + maintainer + owner + permission access_duo_chat = developer + maintainer + owner + permission access_ai_review_mr = developer + maintainer + owner + permission admin_duo_workflow = owner + permission read_duo_workflow = developer + maintainer + owner + permission update_duo_workflow = maintainer + owner + permission destroy_duo_workflow = owner + permission execute_duo_workflow_in_ci = developer + maintainer + owner + + // Group settings permissions + permission change_share_with_group_lock = owner + permission change_prevent_sharing_groups_outside_hierarchy = owner + permission change_prevent_group_forking = owner + permission set_emails_disabled = owner + permission set_show_diff_preview_in_email = owner + permission change_new_user_signups_cap = owner + permission change_seat_control = owner + + // Additional permissions + permission create_projects = maintainer + owner + permission transfer_projects = owner + permission import_projects = owner + permission admin_namespace = owner + permission read_namespace = guest + reporter + developer + maintainer + owner + permission admin_namespace_cluster_agent_mapping = owner + permission read_namespace_cluster_agent_mapping = guest + reporter + developer + maintainer + owner + permission create_subgroup = owner + permission list_subgroup_epics = reporter + developer + maintainer + owner + permission admin_integrations = owner + permission read_group_member = guest + reporter + developer + maintainer + owner + permission read_group_metadata = guest + reporter + developer + maintainer + owner + permission read_group_activity = guest + reporter + developer + maintainer + owner + permission read_group_issues = guest + reporter + developer + maintainer + owner + permission read_group_merge_requests = guest + reporter + developer + maintainer + owner + permission read_group_milestones = guest + reporter + developer + maintainer + owner + permission read_group_boards = guest + reporter + developer + maintainer + owner + permission read_group_release_stats = reporter + developer + maintainer + owner + permission read_group_credentials_inventory = owner + permission admin_group_credentials_inventory = owner + permission create_custom_emoji = developer + maintainer + owner + permission read_custom_emoji = guest + reporter + developer + maintainer + owner + permission delete_custom_emoji = owner + permission upload_file = guest + reporter + developer + maintainer + owner + permission read_upload = guest + reporter + developer + maintainer + owner + permission destroy_upload = maintainer + owner + permission admin_upload = owner + permission create_group_stage = owner + permission read_group_stage = guest + reporter + developer + maintainer + owner + permission update_group_stage = owner + permission delete_group_stage = owner + permission admin_ldap_group_links = owner + permission admin_saml_group_links = owner + permission admin_group_saml = owner + permission read_group_saml_identity = owner + permission create_jira_connect_subscription = owner + permission read_billable_member = owner + permission read_billing = owner + permission edit_billing = owner + permission start_trial = owner + permission admin_licensed_seat = owner + permission update_subscription_limit = owner + permission read_usage_quotas = owner + permission admin_push_rules = owner + permission change_push_rules = owner + permission change_commit_committer_check = owner + permission change_commit_committer_name_check = owner + permission change_reject_unsigned_commits = owner + permission change_reject_non_dco_commits = owner + permission enable_secret_push_protection = owner + permission read_saml_user = owner + permission read_limit_alert = owner + permission read_licenses = owner + permission read_dependency = guest + reporter + developer + maintainer + owner + permission read_lifecycle = reporter + developer + maintainer + owner + permission read_counts = reporter + developer + maintainer + owner + permission manage_merge_request_settings = owner + permission update_approval_rule = owner + permission export_group_memberships = owner + permission rollover_issues = owner + permission admin_achievement = owner + permission read_achievement = guest + reporter + developer + maintainer + owner + permission award_achievement = owner + permission read_insights = reporter + developer + maintainer + owner + permission read_resource_access_tokens = maintainer + owner + permission create_resource_access_tokens = owner + permission destroy_resource_access_tokens = owner + permission manage_resource_access_tokens = owner + permission admin_setting_to_allow_resource_access_token_creation = owner + permission read_member_role = guest + reporter + developer + maintainer + owner + permission admin_member_role = owner + permission view_member_roles = guest + reporter + developer + maintainer + owner + permission generate_description = developer + maintainer + owner + permission read_virtual_registry = guest + reporter + developer + maintainer + owner + permission create_virtual_registry = owner + permission update_virtual_registry = owner + permission destroy_virtual_registry = owner + permission create_saved_replies = developer + maintainer + owner + permission read_saved_replies = guest + reporter + developer + maintainer + owner + permission update_saved_replies = developer + maintainer + owner + permission destroy_saved_replies = developer + maintainer + owner + permission admin_value_stream = owner + permission modify_value_stream_dashboard_settings = owner + permission read_internal_note = reporter + developer + maintainer + owner + permission read_note = guest + reporter + developer + maintainer + owner + permission create_note = guest + reporter + developer + maintainer + owner + permission admin_note = maintainer + owner + permission mark_note_as_internal = reporter + developer + maintainer + owner + permission award_emoji = guest + reporter + developer + maintainer + owner + permission admin_web_hook = owner + permission read_web_hook = maintainer + owner + permission manage_devops_adoption_namespaces = owner + permission provision_cloud_runner = owner + permission provision_gke_runner = owner + permission read_runner_cloud_provisioning_info = owner + permission read_runner_gke_provisioning_info = owner + permission use_k = developer + maintainer + owner + permission view_type_of_work_charts = reporter + developer + maintainer + owner + permission view_edit_page = developer + maintainer + owner + permission view_globally = guest + reporter + developer + maintainer + owner + permission summarize_comments = developer + maintainer + owner + permission set_note_created_at = owner + permission set_issue_created_at = owner + permission set_issue_updated_at = owner + permission set_epic_created_at = owner + permission set_epic_updated_at = owner + permission set_show_default_award_emojis = owner + permission set_warn_about_potentially_unwanted_characters = owner + permission measure_comment_temperature = developer + maintainer + owner + permission read_product_analytics = reporter + developer + maintainer + owner + permission modify_product_analytics_settings = owner + permission read_harbor_registry = reporter + developer + maintainer + owner + permission read_cluster = reporter + developer + maintainer + owner + permission admin_cluster = owner + permission create_cluster = owner + permission update_cluster = owner + permission add_cluster = owner + permission read_cluster_agent = reporter + developer + maintainer + owner + permission read_cluster_environments = reporter + developer + maintainer + owner + permission read_prometheus = reporter + developer + maintainer + owner + permission read_grafana = reporter + developer + maintainer + owner + permission admin_protected_environments = owner + permission export_work_items = reporter + developer + maintainer + owner + permission import_work_items = developer + maintainer + owner + permission admin_work_item = reporter + developer + maintainer + owner + permission read_work_item = guest + reporter + developer + maintainer + owner + permission create_work_item = guest + reporter + developer + maintainer + owner + permission update_work_item = reporter + developer + maintainer + owner + permission admin_issue = reporter + developer + maintainer + owner + permission read_issue = guest + reporter + developer + maintainer + owner + permission create_issue = guest + reporter + developer + maintainer + owner + permission update_issue = reporter + developer + maintainer + owner + permission destroy_issue = owner + permission reopen_issue = reporter + developer + maintainer + owner + permission create_task = guest + reporter + developer + maintainer + owner + permission create_key_result = developer + maintainer + owner + permission create_objective = developer + maintainer + owner + permission set_issue_metadata = reporter + developer + maintainer + owner + permission set_work_item_metadata = reporter + developer + maintainer + owner + permission clone_issue = reporter + developer + maintainer + owner + permission clone_work_item = reporter + developer + maintainer + owner + permission move_issue = reporter + developer + maintainer + owner + permission move_work_item = reporter + developer + maintainer + owner + permission admin_merge_request = developer + maintainer + owner + permission update_merge_request = developer + maintainer + owner + permission create_epic_tree_relation = developer + maintainer + owner + permission admin_epic_relation = developer + maintainer + owner + permission admin_epic_link_relation = developer + maintainer + owner + permission admin_epic_tree_relation = developer + maintainer + owner + permission bulk_admin_epic = owner + permission read_epic_iid = guest + reporter + developer + maintainer + owner + permission read_epic_relation = guest + reporter + developer + maintainer + owner + permission read_epic_link_relation = guest + reporter + developer + maintainer + owner + permission set_epic_metadata = reporter + developer + maintainer + owner + permission set_confidentiality = reporter + developer + maintainer + owner + permission create_timelog = reporter + developer + maintainer + owner + permission admin_timelog = owner + permission read_timelog_category = guest + reporter + developer + maintainer + owner + permission read_issuable = guest + reporter + developer + maintainer + owner + permission read_issuable_participables = guest + reporter + developer + maintainer + owner + permission create_todo = guest + reporter + developer + maintainer + owner + permission update_todo = guest + reporter + developer + maintainer + owner + permission read_todo = guest + reporter + developer + maintainer + owner + permission update_subscription = guest + reporter + developer + maintainer + owner + permission reopen_merge_request = developer + maintainer + owner + permission resolve_note = developer + maintainer + owner + permission reposition_note = developer + maintainer + owner + permission request_access = guest + permission withdraw_member_access_request = guest + reporter + developer + maintainer + owner + permission read_shared_with_group = guest + reporter + developer + maintainer + owner + permission update_default_branch_protection = owner + permission update_git_access_protocol = owner + permission update_max_artifacts_size = owner + permission read_statistics = reporter + developer + maintainer + owner + permission read_cycle_analytics = reporter + developer + maintainer + owner + permission read_design_activity = reporter + developer + maintainer + owner + permission read_namespace_via_membership = guest + reporter + developer + maintainer + owner + permission read_nested_project_resources = guest + reporter + developer + maintainer + owner + permission read_namespace_catalog = guest + reporter + developer + maintainer + owner + permission read_dora = reporter + developer + maintainer + owner + permission read_enterprise_ai_analytics = reporter + developer + maintainer + owner + permission read_pro_ai_analytics = reporter + developer + maintainer + owner + permission read_security_inventory = developer + maintainer + owner + permission read_security_configuration = developer + maintainer + owner + permission read_security_orchestration_policies = developer + maintainer + owner + permission read_security_orchestration_policy_project = developer + maintainer + owner + permission update_security_orchestration_policy_project = owner + permission modify_security_policy = owner + permission admin_security_testing = owner + permission enable_continuous_vulnerability_scans = owner + permission configure_secret_detection_validity_checks = owner + permission read_secret_detection_validity_checks_status = developer + maintainer + owner + permission read_secret_push_protection_info = developer + maintainer + owner + permission admin_merge_request_approval_settings = owner + permission modify_approvers_rules = owner + permission modify_merge_request_author_setting = owner + permission modify_merge_request_committer_setting = owner + permission edit_group_approval_rule = owner + permission read_group_approval_rule = reporter + developer + maintainer + owner + permission create_vulnerability_export = developer + maintainer + owner + permission read_vulnerability_export = developer + maintainer + owner + permission read_vulnerability_statistics = reporter + developer + maintainer + owner + permission read_jobs_statistics = reporter + developer + maintainer + owner + permission read_runner_usage = owner + permission read_runners_registration_token = owner + permission update_runners_registration_token = owner + permission read_package_within_public_registries = guest + reporter + developer + maintainer + owner + permission read_code = guest + reporter + developer + maintainer + owner + permission read_resource_state_event = guest + reporter + developer + maintainer + owner + permission read_resource_weight_event = guest + reporter + developer + maintainer + owner + permission read_resource_iteration_event = guest + reporter + developer + maintainer + owner + permission read_resource_milestone_event = guest + reporter + developer + maintainer + owner + permission read_resource_label_event = guest + reporter + developer + maintainer + owner + permission admin_group_model_selection = owner + permission read_event = guest + reporter + developer + maintainer + owner + permission use_quick_actions = guest + reporter + developer + maintainer + owner + permission use_slash_commands = guest + reporter + developer + maintainer + owner + permission receive_notifications = guest + reporter + developer + maintainer + owner +} + +definition project { + relation ci_job_token: ci_job + relation deploy_token: deploy_token relation developer: user + relation group: group + relation guest: user + relation internal_access: user relation maintainer: user + relation namespace: user relation owner: user - relation admin: user + relation planner: user + relation project_bot: user + relation public_access: user:* + relation reporter: user + + // Core access permissions + permission read_project = guest + reporter + developer + maintainer + owner + group->read + namespace->read + public_access + internal_access + permission guest_access = guest + reporter + developer + maintainer + owner + permission reporter_access = reporter + developer + maintainer + owner + permission developer_access = developer + maintainer + owner + permission maintainer_access = maintainer + owner + permission owner_access = owner + permission planner_access = planner + reporter + developer + maintainer + owner + permission public_access = public_access + permission public_user_access = public_access + internal_access + permission project_bot_access = project_bot + permission build_read_project = ci_job_token + permission read_project_for_iids = guest + reporter + developer + maintainer + owner + group->read + + // Administrative permissions + permission admin_project = owner + group->admin_group + permission archive_project = owner + permission remove_project = owner + group->admin_group + permission change_visibility_level = owner + group->admin_group + permission change_namespace = owner + permission rename_project = maintainer + owner + permission set_emails_disabled = owner + permission set_show_diff_preview_in_email = owner + permission set_show_default_award_emojis = owner + permission set_warn_about_potentially_unwanted_characters = owner + permission manage_owners = owner + + // Code and repository permissions + permission read_code = guest + reporter + developer + maintainer + owner + ci_job_token + deploy_token + group->read + permission download_code = guest + reporter + developer + maintainer + owner + ci_job_token + deploy_token + permission build_download_code = guest + ci_job_token + permission download_code_spp_repository = developer + maintainer + owner + permission push_code = developer + maintainer + owner + permission build_push_code = ci_job_token + permission push_code_to_protected_branches = maintainer + owner + permission push_to_delete_protected_branch = maintainer + owner + permission fork_project = reporter + developer + maintainer + owner + permission link_forked_project = developer + maintainer + owner + permission remove_fork_project = owner + + // Wiki permissions + permission create_wiki = developer + maintainer + owner + permission admin_wiki = maintainer + owner + permission read_wiki = guest + reporter + developer + maintainer + owner + permission read_wiki_page = guest + reporter + developer + maintainer + owner + permission download_wiki_code = reporter + developer + maintainer + owner + + // Snippet permissions + permission create_snippet = developer + maintainer + owner + permission admin_snippet = maintainer + owner + permission read_snippet = guest + reporter + developer + maintainer + owner + permission update_snippet = maintainer + owner + + // Milestone permissions + permission admin_milestone = reporter + developer + maintainer + owner + permission read_milestone = guest + reporter + developer + maintainer + owner + permission read_resource_milestone_event = guest + reporter + developer + maintainer + owner + + // Label permissions + permission admin_label = reporter + developer + maintainer + owner + permission read_label = guest + reporter + developer + maintainer + owner + permission read_resource_label_event = guest + reporter + developer + maintainer + owner + + // Branch and tag permissions + permission admin_tag = maintainer + owner + permission delete_tag = maintainer + owner + permission create_branch_rule = maintainer + owner + permission read_branch_rule = guest + reporter + developer + maintainer + owner + permission update_branch_rule = maintainer + owner + permission destroy_branch_rule = owner + permission admin_protected_branch = maintainer + owner + permission create_protected_branch = maintainer + owner + permission read_protected_branch = guest + reporter + developer + maintainer + owner + permission update_protected_branch = maintainer + owner + permission destroy_protected_branch = owner + permission create_protected_tags = maintainer + owner + permission read_protected_tags = guest + reporter + developer + maintainer + owner + permission update_protected_tags = maintainer + owner + permission destroy_protected_tags = owner + permission manage_protected_tags = maintainer + owner + permission admin_target_branch_rule = owner + permission read_target_branch_rule = guest + reporter + developer + maintainer + owner + permission update_squash_option = developer + maintainer + owner + permission create_squash_option = developer + maintainer + owner + permission read_squash_option = guest + reporter + developer + maintainer + owner + permission destroy_squash_option = owner + + // CI/CD permissions + permission read_build = reporter + developer + maintainer + owner + ci_job_token + permission create_build = developer + maintainer + owner + permission update_build = developer + maintainer + owner + permission cancel_build = developer + maintainer + owner + permission erase_build = maintainer + owner + permission play_job = developer + maintainer + owner + permission read_job_artifacts = reporter + developer + maintainer + owner + ci_job_token + permission destroy_artifacts = maintainer + owner + permission admin_build = maintainer + owner + permission create_pipeline = developer + maintainer + owner + ci_job_token + permission create_bot_pipeline = developer + maintainer + owner + permission read_pipeline = guest + reporter + developer + maintainer + owner + permission update_pipeline = developer + maintainer + owner + permission cancel_pipeline = developer + maintainer + owner + permission destroy_pipeline = owner + permission admin_pipeline = maintainer + owner + permission read_pipeline_variable = developer + maintainer + owner + permission set_pipeline_variables = developer + maintainer + owner + permission read_pipeline_metadata = reporter + developer + maintainer + owner + permission admin_cicd_variables = maintainer + owner + group->admin_cicd_variables + permission change_restrict_user_defined_variables = owner + + // Pipeline schedule permissions + permission create_pipeline_schedule = developer + maintainer + owner + permission read_pipeline_schedule = reporter + developer + maintainer + owner + permission update_pipeline_schedule = developer + maintainer + owner + permission admin_pipeline_schedule = maintainer + owner + permission play_pipeline_schedule = developer + maintainer + owner + permission take_ownership_pipeline_schedule = developer + maintainer + owner + permission read_pipeline_schedule_variables = developer + maintainer + owner + permission read_ci_pipeline_schedules_plan_limit = reporter + developer + maintainer + owner + + // Commit status permissions + permission create_commit_status = developer + maintainer + owner + permission read_commit_status = reporter + developer + maintainer + owner + permission update_commit_status = developer + maintainer + owner + permission admin_commit_status = maintainer + owner + + // Issue permissions + permission create_issue = guest + reporter + developer + maintainer + owner + permission read_issue = guest + reporter + developer + maintainer + owner + permission update_issue = reporter + developer + maintainer + owner + permission admin_issue = reporter + developer + maintainer + owner + permission destroy_issue = owner + permission reopen_issue = reporter + developer + maintainer + owner + permission set_issue_iid = owner + permission set_issue_created_at = owner + permission set_issue_updated_at = owner + permission set_issue_metadata = reporter + developer + maintainer + owner + permission set_issue_crm_contacts = reporter + developer + maintainer + owner + permission set_confidentiality = reporter + developer + maintainer + owner + permission read_issue_iid = guest + reporter + developer + maintainer + owner + permission create_incident = reporter + developer + maintainer + owner + permission import_issues = developer + maintainer + owner + permission export_work_items = reporter + developer + maintainer + owner + permission import_work_items = developer + maintainer + owner + permission clone_issue = reporter + developer + maintainer + owner + permission move_issue = reporter + developer + maintainer + owner + permission promote_to_epic = reporter + developer + maintainer + owner + permission read_confidential_issues = reporter + developer + maintainer + owner + permission mark_issue_for_publication = maintainer + owner + + // Work item permissions + permission create_work_item = guest + reporter + developer + maintainer + owner + permission read_work_item = guest + reporter + developer + maintainer + owner + permission update_work_item = reporter + developer + maintainer + owner + permission admin_work_item = reporter + developer + maintainer + owner + permission delete_work_item = owner + permission clone_work_item = reporter + developer + maintainer + owner + permission move_work_item = reporter + developer + maintainer + owner + permission set_work_item_metadata = reporter + developer + maintainer + owner + permission admin_work_item_link = maintainer + owner + permission admin_parent_link = maintainer + owner + permission read_work_item_type = guest + reporter + developer + maintainer + owner + permission read_work_item_status = guest + reporter + developer + maintainer + owner + permission create_task = guest + reporter + developer + maintainer + owner + permission create_key_result = developer + maintainer + owner + permission create_objective = developer + maintainer + owner + + // Issue board permissions + permission admin_issue_board = reporter + developer + maintainer + owner + permission read_issue_board = guest + reporter + developer + maintainer + owner + permission admin_issue_board_list = reporter + developer + maintainer + owner + permission read_issue_board_list = guest + reporter + developer + maintainer + owner + permission create_non_backlog_issues = reporter + developer + maintainer + owner + + // Issue link permissions + permission admin_issue_link = reporter + developer + maintainer + owner + permission read_issue_link = guest + reporter + developer + maintainer + owner + permission admin_issue_relation = reporter + developer + maintainer + owner + permission create_external_issue_link = developer + maintainer + owner + + // Merge request permissions + permission create_merge_request_from = developer + maintainer + owner + permission create_merge_request_in = developer + maintainer + owner + permission read_merge_request = guest + reporter + developer + maintainer + owner + permission update_merge_request = developer + maintainer + owner + permission admin_merge_request = developer + maintainer + owner + permission accept_merge_request = maintainer + owner + permission approve_merge_request = developer + maintainer + owner + permission destroy_merge_request = owner + permission reopen_merge_request = developer + maintainer + owner + permission read_merge_request_iid = guest + reporter + developer + maintainer + owner + permission set_merge_request_metadata = developer + maintainer + owner + permission create_merge_request_approval_rules = maintainer + owner + permission update_approvers = maintainer + owner + permission admin_merge_request_approval_settings = owner + permission reset_merge_request_approvals = maintainer + owner + permission modify_approvers_rules = owner + permission modify_merge_request_author_setting = owner + permission modify_merge_request_committer_setting = owner + permission manage_merge_request_settings = owner + permission read_approval_rule = reporter + developer + maintainer + owner + permission update_approval_rule = maintainer + owner + permission edit_approval_rule = maintainer + owner + permission read_approvers = reporter + developer + maintainer + owner + permission read_merge_request_closing_issue = guest + reporter + developer + maintainer + owner + permission read_merge_train = reporter + developer + maintainer + owner + permission read_merge_train_car = reporter + developer + maintainer + owner + permission delete_merge_train_car = maintainer + owner + + // Design permissions + permission create_design = reporter + developer + maintainer + owner + permission read_design = guest + reporter + developer + maintainer + owner + permission update_design = developer + maintainer + owner + permission destroy_design = developer + maintainer + owner + permission move_design = developer + maintainer + owner + permission read_design_activity = guest + reporter + developer + maintainer + owner + + // Container and package permissions + permission read_container_image = reporter + developer + maintainer + owner + ci_job_token + permission create_container_image = developer + maintainer + owner + permission update_container_image = developer + maintainer + owner + permission admin_container_image = maintainer + owner + permission destroy_container_image = maintainer + owner + permission destroy_container_image_tag = maintainer + owner + permission build_read_container_image = guest + ci_job_token + permission create_container_registry_protection_immutable_tag_rule = owner + permission destroy_container_registry_protection_tag_rule = developer + maintainer + owner + permission enable_container_scanning_for_registry = owner + permission read_package = reporter + developer + maintainer + owner + permission create_package = developer + maintainer + owner + permission destroy_package = maintainer + owner + permission admin_package = maintainer + owner + permission read_package_within_public_registries = guest + reporter + developer + maintainer + owner + permission view_package_registry_project_settings = reporter + developer + maintainer + owner + + // Deploy token permissions + permission create_deploy_token = maintainer + owner + permission read_deploy_token = maintainer + owner + permission destroy_deploy_token = maintainer + owner + permission update_deploy_token = maintainer + owner + permission manage_deploy_tokens = maintainer + owner + + // Environment and deployment permissions + permission create_environment = developer + maintainer + owner + permission read_environment = reporter + developer + maintainer + owner + permission update_environment = developer + maintainer + owner + permission admin_environment = maintainer + owner + permission destroy_environment = developer + maintainer + owner + permission stop_environment = developer + maintainer + owner + permission create_environment_terminal = maintainer + owner + permission create_deployment = developer + maintainer + owner + permission read_deployment = reporter + developer + maintainer + owner + permission update_deployment = developer + maintainer + owner + permission admin_deployment = maintainer + owner + permission destroy_deployment = maintainer + owner + permission approve_deployment = maintainer + owner + permission admin_protected_environments = owner + permission read_freeze_period = reporter + developer + maintainer + owner + permission create_freeze_period = maintainer + owner + permission update_freeze_period = maintainer + owner + permission destroy_freeze_period = maintainer + owner + + // Feature flag permissions + permission create_feature_flag = developer + maintainer + owner + permission read_feature_flag = reporter + developer + maintainer + owner + permission update_feature_flag = developer + maintainer + owner + permission admin_feature_flag = maintainer + owner + permission destroy_feature_flag = developer + maintainer + owner + permission admin_feature_flags_client = maintainer + owner + permission admin_feature_flags_user_lists = maintainer + owner + permission admin_feature_flags_issue_links = maintainer + owner - permission read = developer + maintainer - permission write = maintainer + // Security and vulnerability permissions + permission read_vulnerability = reporter + developer + maintainer + owner + permission admin_vulnerability = developer + maintainer + owner + group->admin_vulnerability + permission create_vulnerability_feedback = developer + maintainer + owner + permission read_vulnerability_feedback = reporter + developer + maintainer + owner + permission update_vulnerability_feedback = developer + maintainer + owner + permission destroy_vulnerability_feedback = developer + maintainer + owner + permission read_vulnerability_scanner = reporter + developer + maintainer + owner + permission read_vulnerability_merge_request_link = reporter + developer + maintainer + owner + permission admin_vulnerability_merge_request_link = developer + maintainer + owner + permission admin_vulnerability_issue_link = developer + maintainer + owner + permission admin_vulnerability_external_issue_link = developer + maintainer + owner + permission create_vulnerability_export = developer + maintainer + owner + permission read_vulnerability_export = developer + maintainer + owner + permission create_vulnerability_archive_export = developer + maintainer + owner + permission read_vulnerability_archive_export = developer + maintainer + owner + permission create_vulnerability_state_transition = developer + maintainer + owner + permission read_vulnerability_representation_information = reporter + developer + maintainer + owner + permission resolve_vulnerability_with_ai = developer + maintainer + owner + permission read_vulnerability_statistics = reporter + developer + maintainer + owner + + // Security scanning permissions + permission access_security_and_compliance = developer + maintainer + owner + permission access_security_scans_api = developer + maintainer + owner + permission read_security_dashboard = reporter + developer + maintainer + owner + permission read_project_security_dashboard = reporter + developer + maintainer + owner + permission add_project_to_instance_security_dashboard = owner + permission read_instance_security_dashboard = owner + permission read_security_configuration = developer + maintainer + owner + permission read_security_orchestration_policies = developer + maintainer + owner + permission read_security_orchestration_policy_project = developer + maintainer + owner + permission update_security_orchestration_policy_project = owner + permission modify_security_policy = owner + permission admin_security_testing = owner + permission manage_security_settings = owner + permission read_security_settings = reporter + developer + maintainer + owner + permission read_security_inventory = developer + maintainer + owner + permission read_security_resource = developer + maintainer + owner + permission read_project_security_exclusions = developer + maintainer + owner + permission manage_project_security_exclusions = owner + permission enable_continuous_vulnerability_scans = owner + permission configure_secret_detection_validity_checks = owner + permission read_secret_detection_validity_checks_status = developer + maintainer + owner + permission read_secret_push_protection_info = developer + maintainer + owner + permission enable_secret_push_protection = owner + permission read_coverage_fuzzing = developer + maintainer + owner + permission create_coverage_fuzzing_corpus = developer + maintainer + owner + + // Release permissions + permission create_release = developer + maintainer + owner + permission read_release = guest + reporter + developer + maintainer + owner + permission update_release = developer + maintainer + owner + permission destroy_release = maintainer + owner + permission read_release_evidence = guest + reporter + developer + maintainer + owner + + // Runner permissions + permission admin_runner = owner + group->admin_runner + permission read_runner = reporter + developer + maintainer + owner + permission update_runner = owner + permission delete_runner = owner + permission assign_runner = maintainer + owner + permission create_runner = maintainer + owner + permission register_project_runners = maintainer + owner + permission admin_project_runners = maintainer + owner + permission read_project_runners = reporter + developer + maintainer + owner + permission read_runners_registration_token = maintainer + owner + permission update_runners_registration_token = maintainer + owner + permission read_runner_usage = owner + permission read_runner_cloud_provisioning_info = owner + permission read_runner_gke_provisioning_info = owner + permission provision_cloud_runner = owner + permission provision_gke_runner = owner + + // Pages permissions + permission admin_pages = maintainer + owner + permission read_pages = maintainer + owner + permission update_pages = maintainer + owner + permission remove_pages = maintainer + owner + permission read_pages_content = guest + reporter + developer + maintainer + owner + permission read_pages_deployments = reporter + developer + maintainer + owner + permission update_pages_deployments = maintainer + owner + permission pages_multiple_versions = maintainer + owner + + // Terraform state permissions + permission read_terraform_state = developer + maintainer + owner + permission admin_terraform_state = maintainer + owner + + // Analytics permissions + permission read_analytics = reporter + developer + maintainer + owner + permission read_insights = reporter + developer + maintainer + owner + permission read_ci_cd_analytics = reporter + developer + maintainer + owner + permission read_code_review_analytics = reporter + developer + maintainer + owner + permission read_issue_analytics = reporter + developer + maintainer + owner + permission read_project_merge_request_analytics = reporter + developer + maintainer + owner + permission read_combined_project_analytics_dashboards = reporter + developer + maintainer + owner + permission read_project_level_value_stream_dashboard_overview_counts = reporter + developer + maintainer + owner + permission view_productivity_analytics = reporter + developer + maintainer + owner + permission read_cycle_analytics = reporter + developer + maintainer + owner + permission read_repository_graphs = reporter + developer + maintainer + owner + permission read_statistics = reporter + developer + maintainer + owner + permission daily_statistics = reporter + developer + maintainer + owner + permission read_build_report_results = reporter + developer + maintainer + owner + permission use_project_statistics_filters = reporter + developer + maintainer + owner + permission admin_value_stream = owner + + // AI/Duo permissions + permission access_duo_features = developer + maintainer + owner + group->access_duo_features + permission access_duo_chat = developer + maintainer + owner + permission access_ai_review_mr = developer + maintainer + owner + permission access_duo_agentic_chat = developer + maintainer + owner + permission access_duo_core_features = developer + maintainer + owner + permission access_description_composer = developer + maintainer + owner + permission access_summarize_new_merge_request = developer + maintainer + owner + permission access_summarize_review = developer + maintainer + owner + permission access_generate_commit_message = developer + maintainer + owner + permission duo_workflow = developer + maintainer + owner + permission trigger_amazon_q = developer + maintainer + owner + permission generate_description = developer + maintainer + owner + permission generate_cube_query = developer + maintainer + owner + permission read_ai_agents = reporter + developer + maintainer + owner + permission write_ai_agents = developer + maintainer + owner + + // Model registry permissions (ML) + permission read_model_experiments = reporter + developer + maintainer + owner + permission write_model_experiments = developer + maintainer + owner + permission read_model_registry = reporter + developer + maintainer + owner + permission write_model_registry = developer + maintainer + owner + + // Observability permissions + permission read_observability = reporter + developer + maintainer + owner + permission write_observability = developer + maintainer + owner + + // Compliance permissions + permission admin_compliance_framework = owner + group->admin_compliance_framework + permission read_compliance_framework = reporter + developer + maintainer + owner + permission read_compliance_dashboard = reporter + developer + maintainer + owner + permission read_compliance_adherence_report = developer + maintainer + owner + permission read_compliance_violations_report = developer + maintainer + owner + permission read_project_audit_events = owner + + // Member and access permissions + permission admin_project_member = maintainer + owner + permission read_project_member = guest + reporter + developer + maintainer + owner + permission update_project_member = maintainer + owner + permission destroy_project_member = owner + permission destroy_project_bot_member = owner + permission invite_member = maintainer + owner + permission invite_project_members = maintainer + owner + permission import_project_members_from_another_project = maintainer + owner + permission admin_member_access_request = maintainer + owner + permission read_member_access_request = guest + reporter + developer + maintainer + owner + permission withdraw_member_access_request = guest + reporter + developer + maintainer + owner + permission override_group_member = owner + permission destroy_group_member = owner + permission destroy_project_group_link = owner + permission manage_group_link_with_owner_access = owner + permission read_shared_with_group = guest + reporter + developer + maintainer + owner + + // Note and comment permissions + permission create_note = guest + reporter + developer + maintainer + owner + permission read_note = guest + reporter + developer + maintainer + owner + permission update_note = guest + reporter + developer + maintainer + owner + permission admin_note = maintainer + owner + permission resolve_note = developer + maintainer + owner + permission reposition_note = developer + maintainer + owner + permission mark_note_as_internal = reporter + developer + maintainer + owner + permission set_note_created_at = owner + permission read_internal_note = reporter + developer + maintainer + owner + permission award_emoji = guest + reporter + developer + maintainer + owner + permission summarize_comments = developer + maintainer + owner + permission measure_comment_temperature = developer + maintainer + owner + + // Webhook permissions + permission admin_web_hook = owner + permission read_web_hook = maintainer + owner + + // Upload permissions + permission upload_file = guest + reporter + developer + maintainer + owner + permission read_upload = guest + reporter + developer + maintainer + owner + permission destroy_upload = maintainer + owner + permission admin_upload = owner + + // Project settings permissions + permission admin_project_aws = owner + permission admin_project_google_cloud = owner + permission admin_project_secrets_manager = owner + permission admin_google_cloud_artifact_registry = owner + permission read_google_cloud_artifact_registry = reporter + developer + maintainer + owner + permission update_max_artifacts_size = owner + permission set_pipeline_variables = developer + maintainer + owner + permission change_commit_committer_check = owner + permission change_commit_committer_name_check = owner + permission read_commit_committer_check = reporter + developer + maintainer + owner + permission read_commit_committer_name_check = reporter + developer + maintainer + owner + permission change_push_rules = owner + permission admin_push_rules = owner + permission change_reject_unsigned_commits = owner + permission change_reject_non_dco_commits = owner + permission read_reject_unsigned_commits = reporter + developer + maintainer + owner + permission read_reject_non_dco_commits = reporter + developer + maintainer + owner + + // Integration permissions + permission admin_integrations = maintainer + owner + permission create_jira_connect_subscription = owner + permission admin_operations = maintainer + owner + permission admin_sentry = maintainer + owner + permission read_sentry_issue = reporter + developer + maintainer + owner + permission update_sentry_issue = developer + maintainer + owner + + // Misc permissions + permission add_catalog_resource = owner + permission publish_catalog_version = developer + maintainer + owner + permission read_namespace_catalog = guest + reporter + developer + maintainer + owner + permission create_project = developer + maintainer + owner + permission request_access = guest + permission read_project_metadata = guest + reporter + developer + maintainer + owner + permission view_edit_page = developer + maintainer + owner + permission metrics_dashboard = reporter + developer + maintainer + owner + permission read_operations_dashboard = owner + permission use_k = developer + maintainer + owner + permission use_quick_actions = guest + reporter + developer + maintainer + owner + permission use_slash_commands = guest + reporter + developer + maintainer + owner + permission create_timelog = reporter + developer + maintainer + owner + permission admin_timelog = owner + permission read_timelog_category = guest + reporter + developer + maintainer + owner + permission create_todo = guest + reporter + developer + maintainer + owner + permission update_todo = guest + reporter + developer + maintainer + owner + permission read_todo = guest + reporter + developer + maintainer + owner + permission update_subscription = guest + reporter + developer + maintainer + owner + permission delete_project_subscription = owner + permission report_spam = guest + reporter + developer + maintainer + owner + permission read_issuable = guest + reporter + developer + maintainer + owner + permission read_issuable_participables = guest + reporter + developer + maintainer + owner + permission read_issuable_resource_link = guest + reporter + developer + maintainer + owner + permission admin_issuable_resource_link = developer + maintainer + owner + permission read_issuable_metric_image = reporter + developer + maintainer + owner + permission update_issuable_metric_image = developer + maintainer + owner + permission upload_issuable_metric_image = developer + maintainer + owner + permission destroy_issuable_metric_image = developer + maintainer + owner + permission read_incident_management_timeline_event = reporter + developer + maintainer + owner + permission admin_incident_management_timeline_event = developer + maintainer + owner + permission edit_incident_management_timeline_event = developer + maintainer + owner + permission read_incident_management_timeline_event_tag = reporter + developer + maintainer + owner + permission admin_incident_management_timeline_event_tag = maintainer + owner + permission read_incident_management_escalation_policy = reporter + developer + maintainer + owner + permission admin_incident_management_escalation_policy = maintainer + owner + permission read_incident_management_oncall_schedule = reporter + developer + maintainer + owner + permission admin_incident_management_oncall_schedule = maintainer + owner + permission update_escalation_status = developer + maintainer + owner + permission read_alert_management_alert = reporter + developer + maintainer + owner + permission update_alert_management_alert = developer + maintainer + owner + permission read_alert_management_metric_image = reporter + developer + maintainer + owner + permission update_alert_management_metric_image = developer + maintainer + owner + permission upload_alert_management_metric_image = developer + maintainer + owner + permission destroy_alert_management_metric_image = developer + maintainer + owner + permission publish_status_page = developer + maintainer + owner + permission rollover_issues = owner + + // Resource access token permissions + permission read_resource_access_tokens = maintainer + owner + permission create_resource_access_tokens = owner + permission destroy_resource_access_tokens = owner + permission manage_resource_access_tokens = owner + permission admin_setting_to_allow_resource_access_token_creation = owner + + // Path lock permissions + permission create_path_lock = developer + maintainer + owner + permission read_path_locks = guest + reporter + developer + maintainer + owner + permission admin_path_locks = maintainer + owner + permission destroy_path_lock = developer + maintainer + owner + + // On-demand DAST scan permissions + permission create_on_demand_dast_scan = developer + maintainer + owner + permission read_on_demand_dast_scan = developer + maintainer + owner + permission edit_on_demand_dast_scan = developer + maintainer + owner + + // Requirement permissions + permission create_requirement = reporter + developer + maintainer + owner + permission read_requirement = reporter + developer + maintainer + owner + permission update_requirement = reporter + developer + maintainer + owner + permission admin_requirement = maintainer + owner + permission destroy_requirement = maintainer + owner + permission import_requirements = developer + maintainer + owner + permission export_requirements = reporter + developer + maintainer + owner + permission create_requirement_test_report = reporter + developer + maintainer + owner + + // Test case permissions + permission create_test_case = reporter + developer + maintainer + owner + + // Secure file permissions + permission read_secure_files = developer + maintainer + owner + permission admin_secure_files = maintainer + owner + + // License policy permissions + permission read_software_license_policy = reporter + developer + maintainer + owner + permission admin_software_license_policy = maintainer + owner + + // Mirror permissions + permission admin_mirror = owner + permission admin_remote_mirror = owner + + // Trigger permissions + permission admin_trigger = owner + permission manage_trigger = owner + + // Cluster permissions + permission read_cluster = reporter + developer + maintainer + owner + permission add_cluster = maintainer + owner + permission create_cluster = maintainer + owner + permission update_cluster = maintainer + owner + permission admin_cluster = owner + permission read_cluster_agent = reporter + developer + maintainer + owner + permission read_cluster_environments = reporter + developer + maintainer + owner + + // Prometheus and monitoring permissions + permission read_prometheus = reporter + developer + maintainer + owner + permission read_grafana = reporter + developer + maintainer + owner + permission read_pod_logs = developer + maintainer + owner + + // Harbor registry permissions + permission read_harbor_registry = reporter + developer + maintainer + owner + + // Build service proxy permissions + permission build_service_proxy_enabled = developer + maintainer + owner + permission create_build_service_proxy = developer + maintainer + owner + + // Web IDE permissions + permission create_web_ide_terminal = developer + maintainer + owner + permission read_web_ide_terminal = developer + maintainer + owner + permission update_web_ide_terminal = developer + maintainer + owner + + // Resource group permissions + permission read_resource_group = reporter + developer + maintainer + owner + permission update_resource_group = developer + maintainer + owner + + // Deploy board permissions + permission read_deploy_board = reporter + developer + maintainer + owner + + // External email permissions + permission read_external_emails = reporter + developer + maintainer + owner + + // Import/Export permissions + permission read_import_error = owner + permission export_work_items = reporter + developer + maintainer + owner + permission import_work_items = developer + maintainer + owner + + // Saved replies permissions + permission create_saved_replies = developer + maintainer + owner + permission read_saved_replies = guest + reporter + developer + maintainer + owner + permission update_saved_replies = developer + maintainer + owner + permission destroy_saved_replies = developer + maintainer + owner + + // Other permissions + permission cache_blob = guest + reporter + developer + maintainer + owner + permission read_blob = guest + reporter + developer + maintainer + owner + permission read_commit = guest + reporter + developer + maintainer + owner + permission read_build_trace = developer + maintainer + owner + permission read_build_metadata = developer + maintainer + owner + permission jailbreak = owner + permission build_read_container_image = guest + ci_job_token + permission apply_suggestion = developer + maintainer + owner + permission read_project_subscription = guest + reporter + developer + maintainer + owner + permission read_storage_disk_path = owner + permission read_dora = reporter + developer + maintainer + owner + permission read_product_analytics = reporter + developer + maintainer + owner + permission modify_product_analytics_settings = owner + permission read_counts = reporter + developer + maintainer + owner + permission read_dependency = guest + reporter + developer + maintainer + owner + permission read_lifecycle = reporter + developer + maintainer + owner + permission read_usage_quotas = owner + permission read_limit_alert = owner + permission read_licenses = owner + permission read_scan = developer + maintainer + owner + permission read_event = guest + reporter + developer + maintainer + owner + permission read_parent = guest + reporter + developer + maintainer + owner + permission read_namespace = guest + reporter + developer + maintainer + owner + permission read_namespace_via_membership = guest + reporter + developer + maintainer + owner + permission read_nested_project_resources = guest + reporter + developer + maintainer + owner + permission view_globally = guest + reporter + developer + maintainer + owner + permission receive_notifications = guest + reporter + developer + maintainer + owner + permission read_enterprise_ai_analytics = reporter + developer + maintainer + owner + permission read_pro_ai_analytics = reporter + developer + maintainer + owner + permission read_component = guest + reporter + developer + maintainer + owner + permission read_component_version = guest + reporter + developer + maintainer + owner + permission read_application_setting = owner + permission read_resource_state_event = guest + reporter + developer + maintainer + owner + permission read_resource_weight_event = guest + reporter + developer + maintainer + owner + permission read_resource_iteration_event = guest + reporter + developer + maintainer + owner + permission read_resource_milestone_event = guest + reporter + developer + maintainer + owner + permission read_resource_label_event = guest + reporter + developer + maintainer + owner + permission read_deploy_key = maintainer + owner + permission update_deploy_key = maintainer + owner + permission update_deploy_key_title = maintainer + owner + permission update_deploy_keys_project = maintainer + owner + permission read_custom_emoji = guest + reporter + developer + maintainer + owner + permission create_custom_emoji = developer + maintainer + owner + permission delete_custom_emoji = owner + permission read_external_status_check = reporter + developer + maintainer + owner + permission read_external_status_check_response = developer + maintainer + owner + permission provide_status_check_response = developer + maintainer + owner + permission retry_failed_status_checks = developer + maintainer + owner + permission read_jobs_statistics = reporter + developer + maintainer + owner + permission read_finding_token_status = developer + maintainer + owner + permission read_ci_minutes_limited_summary = reporter + developer + maintainer + owner + permission admin_ci_minutes = owner + permission create_build_terminal = developer + maintainer + owner + permission read_builds = reporter + developer + maintainer + owner + permission read_user_achievement = guest + reporter + developer + maintainer + owner + permission destroy_user_achievement = owner + permission read_abuse_report = owner + permission read_emoji = guest + reporter + developer + maintainer + owner + permission read_dependency_list_export = developer + maintainer + owner + permission create_workspace = developer + maintainer + owner + permission read_workspace = developer + maintainer + owner + permission update_workspace = developer + maintainer + owner + permission read_workspace_variable = developer + maintainer + owner + permission read_workspaces_agent_config = developer + maintainer + owner + permission access_workspaces_feature = developer + maintainer + owner + permission modify_value_stream_dashboard_settings = owner + permission read_achievement = guest + reporter + developer + maintainer + owner + permission award_achievement = owner + permission admin_achievement = owner + permission read_all_workspaces = owner + permission read_crm_contact = reporter + developer + maintainer + owner + permission read_crm_contacts = reporter + developer + maintainer + owner + permission set_issue_crm_contacts = reporter + developer + maintainer + owner + permission admin_crm_contact = reporter + developer + maintainer + owner + permission read_crm_organization = reporter + developer + maintainer + owner + permission admin_crm_organization = reporter + developer + maintainer + owner + permission read_custom_field = guest + reporter + developer + maintainer + owner + permission admin_custom_field = owner + permission read_confidential_epic = reporter + developer + maintainer + owner + permission read_epic_iid = guest + reporter + developer + maintainer + owner + permission read_epic_relation = guest + reporter + developer + maintainer + owner + permission read_epic_link_relation = guest + reporter + developer + maintainer + owner + permission admin_epic_relation = developer + maintainer + owner + permission admin_epic_link_relation = developer + maintainer + owner + permission admin_epic_tree_relation = developer + maintainer + owner + permission read_duo_workflow_event = developer + maintainer + owner + permission read_geo_node = owner + permission read_geo_registry = owner + permission read_all_geo = owner + permission read_virtual_registry = guest + reporter + developer + maintainer + owner + permission read_application_statistics = owner + permission read_instance_metadata = owner + permission read_cloud_connector_status = owner + permission read_usage_trends_measurement = owner + permission read_billable_member = owner + permission read_billing = owner + permission edit_billing = owner + permission start_trial = owner + permission read_licensed_seat = owner + permission admin_licensed_seat = owner + permission read_member_role = guest + reporter + developer + maintainer + owner + permission admin_member_role = owner + permission view_member_roles = guest + reporter + developer + maintainer + owner + permission link = guest + reporter + developer + maintainer + owner + permission unlink = guest + reporter + developer + maintainer + owner + permission sign_in_with_saml_provider = guest + reporter + developer + maintainer + owner + permission read_saml_user = owner + permission read_group_saml_identity = owner + permission log_in = guest + reporter + developer + maintainer + owner + permission accept_terms = guest + reporter + developer + maintainer + owner + permission decline_terms = guest + reporter + developer + maintainer + owner + permission access_admin_area = owner + permission access_api = guest + reporter + developer + maintainer + owner + permission access_git = guest + reporter + developer + maintainer + owner + permission access_x_ray_on_instance = owner + permission access_advanced_vulnerability_management = developer + maintainer + owner + permission access_code_suggestions = developer + maintainer + owner + permission access_glab_ask_git_command = developer + maintainer + owner + permission execute_graphql_mutation = guest + reporter + developer + maintainer + owner + permission receive_notifications = guest + reporter + developer + maintainer + owner + permission approve_user = owner + permission reject_user = owner + permission block_pipl_user = owner + permission delete_pipl_user = owner + permission view_instance_devops_adoption = owner + permission manage_devops_adoption_namespaces = owner + permission read_admin_role = owner + permission create_admin_role = owner + permission update_admin_role = owner + permission delete_admin_role = owner + permission destroy_licenses = owner + permission export_user_permissions = owner + permission manage_subscription = owner + permission manage_duo_core_settings = owner + permission read_duo_core_settings = owner + permission manage_self_hosted_models_settings = owner + permission read_self_hosted_models_settings = owner + permission manage_ldap_admin_links = owner + permission read_runner_upgrade_status = owner + permission read_custom_attribute = owner + permission update_custom_attribute = owner + permission read_users_list = owner + permission read_admin_users = owner + permission read_admin_subscription = owner + permission read_admin_system_information = owner + permission read_admin_health_check = owner + permission read_admin_background_jobs = owner + permission read_admin_background_migrations = owner + permission read_admin_cicd = owner + permission read_admin_gitaly_servers = owner + permission read_admin_metrics_dashboard = owner + permission create_instance_runner = owner + permission update_max_pages_size = owner + permission delete_merge_train_car = maintainer + owner + permission provision_cloud_runner = owner + permission provision_gke_runner = owner + permission list_subgroup_epics = reporter + developer + maintainer + owner + permission get_user_associations_count = guest + reporter + developer + maintainer + owner + permission make_profile_private = guest + reporter + developer + maintainer + owner + permission disable_two_factor = owner + permission delete_conversation_thread = owner + permission audit_event_definitions = owner + permission delete_tag = maintainer + owner + permission update_deploy_token = maintainer + owner + permission update_deploy_key = maintainer + owner + permission update_deploy_key_title = maintainer + owner + permission update_deploy_keys_project = maintainer + owner + permission create_virtual_registry = owner + permission update_virtual_registry = owner + permission destroy_virtual_registry = owner + permission admin_dependency_proxy_packages_settings = owner + permission execute_duo_workflow_in_ci = developer + maintainer + owner + permission link_forked_project = developer + maintainer + owner + permission access_x_ray_on_instance = owner + permission read_runner_manager = owner + permission read_ephemeral_token = owner + permission rotate_token = owner + permission revoke_token = owner + permission read_token = owner + permission read_user_personal_access_tokens = owner + permission create_user_personal_access_token = owner + permission admin_user_email_address = owner + permission read_user_email_address = owner + permission read_user_groups = guest + reporter + developer + maintainer + owner + permission read_user_membership_counts = guest + reporter + developer + maintainer + owner + permission read_user_organizations = guest + reporter + developer + maintainer + owner + permission read_user_preference = guest + reporter + developer + maintainer + owner + permission read_user_profile = guest + reporter + developer + maintainer + owner + permission update_name = guest + reporter + developer + maintainer + owner + permission update_user = owner + permission update_user_status = guest + reporter + developer + maintainer + owner + permission destroy_user = owner + permission update_user_achievement = owner + permission update_owned_user_achievement = owner + permission read_usage = owner + permission view_type_of_work_charts = reporter + developer + maintainer + owner + permission admin_import_source_user = owner + permission create_group_with_default_branch_protection = owner + permission create_group_via_api = owner + permission update_escalation_status = developer + maintainer + owner + permission view_package_registry_project_settings = reporter + developer + maintainer + owner + permission admin_group_model_selection = owner + permission edit_on_demand_dast_scan = developer + maintainer + owner + permission edit_billing = owner + permission edit_group_approval_rule = owner + permission edit_approval_rule = maintainer + owner + permission admin_software_license_policy = maintainer + owner + permission read_software_license_policy = reporter + developer + maintainer + owner + permission bulk_admin_epic = owner } -definition group { +definition user { + relation organization_member: organization + relation organization_owner: organization + + permission admin_user = user + organization_owner + permission create_user_personal_access_token = user + permission manage_user_personal_access_token = user + permission read_user = user + organization_member + organization_owner + + // Additional user permissions + permission read_user_profile = user + permission read_user_preference = user + permission read_user_email_address = user + permission admin_user_email_address = user + organization_owner + permission read_user_groups = user + permission read_user_organizations = user + permission read_user_membership_counts = user + permission read_user_personal_access_tokens = user + permission update_user = user + permission update_user_status = user + permission update_name = user + permission destroy_user = user + organization_owner + permission disable_two_factor = user + organization_owner + permission make_profile_private = user + permission get_user_associations_count = user + permission create_saved_replies = user + permission read_saved_replies = user + permission update_saved_replies = user + permission destroy_saved_replies = user + permission create_snippet = user + permission read_user_achievement = user + permission update_user_achievement = user + organization_owner + permission update_owned_user_achievement = user + permission destroy_user_achievement = user + organization_owner + permission receive_notifications = user + permission log_in = user + permission access_api = user + permission access_git = user + permission execute_graphql_mutation = user + permission use_quick_actions = user + permission use_slash_commands = user + permission request_access = user + permission export_user_permissions = organization_owner +} + +// Wiki resource +definition wiki_page { + relation project: project + relation group: group + relation author: user + + permission read_wiki_page = project->read_wiki + group->read_wiki + permission create_note = project->create_note + group->create_note + permission read_note = project->read_note + group->read_note + permission update_subscription = project->guest_access + group->guest_access +} + +// Snippet resource +definition snippet { + relation project: project + relation author: user + relation namespace: user + + permission read_snippet = author + project->read_snippet + permission admin_snippet = author + project->admin_snippet + permission update_snippet = author + project->update_snippet + permission cache_blob = author + project->guest_access + permission create_note = author + project->create_note + permission read_note = project->read_note + permission award_emoji = project->guest_access } -definition resource { - relation reader: user | user:* - relation writer: user | user:* +// Milestone resource +definition milestone { + relation project: project + relation group: group + + permission read_milestone = project->read_milestone + group->read_milestone + permission admin_milestone = project->admin_milestone + group->admin_milestone + permission read_resource_milestone_event = project->read_resource_milestone_event + group->read_resource_milestone_event +} + +// Label resource +definition label { + relation project: project + relation group: group + + permission read_label = project->read_label + group->read_label + permission admin_label = project->admin_label + group->admin_label + permission read_resource_label_event = project->read_resource_label_event + group->read_resource_label_event +} + +// Tag resource +definition tag { + relation project: project + relation creator: user + + permission delete_tag = project->delete_tag + permission admin_tag = project->admin_tag +} + +// Branch resource +definition branch { + relation project: project + + permission create_branch_rule = project->create_branch_rule + permission read_branch_rule = project->read_branch_rule + permission update_branch_rule = project->update_branch_rule + permission destroy_branch_rule = project->destroy_branch_rule +} + +// Protected branch resource +definition protected_branch { + relation project: project + + permission create_protected_branch = project->create_protected_branch + permission read_protected_branch = project->read_protected_branch + permission update_protected_branch = project->update_protected_branch + permission destroy_protected_branch = project->destroy_protected_branch + permission admin_protected_branch = project->admin_protected_branch +} + +// Protected tag resource +definition protected_tag { + relation project: project + + permission create_protected_tags = project->create_protected_tags + permission read_protected_tags = project->read_protected_tags + permission update_protected_tags = project->update_protected_tags + permission destroy_protected_tags = project->destroy_protected_tags + permission manage_protected_tags = project->manage_protected_tags +} + +// Pipeline schedule resource +definition pipeline_schedule { + relation project: project + relation owner: user + + permission read_pipeline_schedule = project->read_pipeline_schedule + permission update_pipeline_schedule = owner + project->update_pipeline_schedule + permission admin_pipeline_schedule = project->admin_pipeline_schedule + permission play_pipeline_schedule = owner + project->play_pipeline_schedule + permission take_ownership_pipeline_schedule = project->take_ownership_pipeline_schedule + permission read_pipeline_schedule_variables = project->read_pipeline_schedule_variables +} - permission read = reader + writer - permission create = writer - permission update = writer - permission delete = writer +// Feature flag resource +definition feature_flag { + relation project: project + + permission create_feature_flag = project->create_feature_flag + permission read_feature_flag = project->read_feature_flag + permission update_feature_flag = project->update_feature_flag + permission admin_feature_flag = project->admin_feature_flag + permission destroy_feature_flag = project->destroy_feature_flag + permission admin_feature_flags_client = project->admin_feature_flags_client + permission admin_feature_flags_user_lists = project->admin_feature_flags_user_lists + permission admin_feature_flags_issue_links = project->admin_feature_flags_issue_links } + +// Alert management resource +definition alert { + relation project: project + + permission read_alert_management_alert = project->read_alert_management_alert + permission update_alert_management_alert = project->update_alert_management_alert + permission read_alert_management_metric_image = project->read_alert_management_metric_image + permission update_alert_management_metric_image = project->update_alert_management_metric_image + permission upload_alert_management_metric_image = project->upload_alert_management_metric_image + permission destroy_alert_management_metric_image = project->destroy_alert_management_metric_image +} + +// Incident management resource +definition incident { + relation project: project + + permission read_incident_management_timeline_event = project->read_incident_management_timeline_event + permission admin_incident_management_timeline_event = project->admin_incident_management_timeline_event + permission edit_incident_management_timeline_event = project->edit_incident_management_timeline_event + permission read_incident_management_timeline_event_tag = project->read_incident_management_timeline_event_tag + permission admin_incident_management_timeline_event_tag = project->admin_incident_management_timeline_event_tag + permission read_incident_management_escalation_policy = project->read_incident_management_escalation_policy + permission admin_incident_management_escalation_policy = project->admin_incident_management_escalation_policy + permission read_incident_management_oncall_schedule = project->read_incident_management_oncall_schedule + permission admin_incident_management_oncall_schedule = project->admin_incident_management_oncall_schedule + permission update_escalation_status = project->update_escalation_status +} + +// On-demand DAST scan resource +definition on_demand_dast_scan { + relation project: project + + permission create_on_demand_dast_scan = project->create_on_demand_dast_scan + permission read_on_demand_dast_scan = project->read_on_demand_dast_scan + permission edit_on_demand_dast_scan = project->edit_on_demand_dast_scan +} + +// Requirement resource +definition requirement { + relation project: project + + permission create_requirement = project->create_requirement + permission read_requirement = project->read_requirement + permission update_requirement = project->update_requirement + permission admin_requirement = project->admin_requirement + permission destroy_requirement = project->destroy_requirement +} + +// Build resource +definition build { + relation project: project + relation pipeline: pipeline + relation user: user + + permission read_build = project->read_build + permission read_build_trace = project->read_build_trace + permission read_build_metadata = project->read_build_metadata + permission read_job_artifacts = project->read_job_artifacts + permission update_build = project->update_build + permission cancel_build = user + project->cancel_build + permission erase_build = project->erase_build + permission play_job = project->play_job + permission create_build_terminal = project->create_build_terminal + permission read_web_ide_terminal = project->read_web_ide_terminal + permission update_web_ide_terminal = project->update_web_ide_terminal + permission create_build_service_proxy = project->create_build_service_proxy + permission update_commit_status = project->update_commit_status +} + +// CI job resource (enhanced) +definition ci_job { + relation pipeline: pipeline + relation project: project + relation runner: runner + + permission create_build = project->create_pipeline + permission download_code = project->download_code + permission read_build = project->read_build + permission read_container_image = project->read_container_image + permission read_project = project->read_project + permission read_ci_minutes_limited_summary = project->read_ci_minutes_limited_summary + permission jailbreak = project->jailbreak +} + +// Pipeline resource (enhanced) +definition pipeline { + relation author: user + relation ci_job_token: ci_job + relation project: project + + permission admin_pipeline = project->admin_pipeline + permission cancel_pipeline = project->developer + author + permission read_pipeline = project->read_project + permission update_pipeline = project->developer + author + ci_job_token + permission destroy_pipeline = project->destroy_pipeline + permission read_pipeline_metadata = project->read_pipeline_metadata + permission read_pipeline_variable = project->read_pipeline_variable +} + +// Runner resource (enhanced) +definition runner { + relation group: group + relation instance: organization + relation organization: organization + relation project: project + + permission admin_runner = project->admin_runner + group->admin_runner + organization->admin_organization + permission assign_runner = project->maintainer + group->maintainer + organization->admin + permission read_runner = project->read_project + group->read + organization->read + permission update_runner = project->admin_runner + group->admin_runner + organization->admin + permission delete_runner = project->admin_runner + group->admin_runner + organization->admin + permission read_builds = project->read_build + group->developer + organization->admin + permission read_ephemeral_token = project->admin_runner + group->admin_runner + organization->admin +} + +// Issue resource (enhanced) +definition issue { + relation assignee: user + relation author: user + relation epic: epic + relation project: project + + permission admin_issue = project->admin_issue + permission create_issue = project->create_issue + permission promote_to_epic = project->reporter + permission read_issue = project->read_project + permission set_confidentiality = project->reporter + permission update_issue = project->admin_issue + author + assignee + permission reopen_issue = project->reopen_issue + permission destroy_issue = project->destroy_issue + permission clone_issue = project->clone_issue + permission move_issue = project->move_issue + permission set_issue_metadata = project->set_issue_metadata + permission set_issue_crm_contacts = project->set_issue_crm_contacts + permission set_issue_iid = project->set_issue_iid + permission set_issue_created_at = project->set_issue_created_at + permission set_issue_updated_at = project->set_issue_updated_at + permission admin_issue_link = project->admin_issue_link + permission read_issue_link = project->read_issue_link + permission admin_issue_relation = project->admin_issue_relation + permission create_note = project->create_note + permission read_note = project->read_note + permission admin_note = project->admin_note + permission award_emoji = project->award_emoji + permission create_todo = project->create_todo + permission mark_note_as_internal = project->mark_note_as_internal + permission read_crm_contacts = project->read_crm_contacts + permission update_subscription = project->update_subscription +} + +// Merge request resource (enhanced) +definition merge_request { + relation assignee: user + relation author: user + relation project: project + relation reviewer: user + + permission accept_merge_request = project->accept_merge_request + permission admin_merge_request = project->developer + author + permission approve_merge_request = project->approve_merge_request + reviewer + permission create_merge_request_from = project->create_merge_request_from + permission read_merge_request = project->read_project + permission update_merge_request = project->update_merge_request + permission destroy_merge_request = project->destroy_merge_request + permission reopen_merge_request = project->reopen_merge_request + permission set_merge_request_metadata = project->set_merge_request_metadata + permission create_merge_request_approval_rules = project->create_merge_request_approval_rules + permission update_approvers = project->update_approvers + permission reset_merge_request_approvals = project->reset_merge_request_approvals + permission create_todo = project->create_todo + permission mark_note_as_internal = project->mark_note_as_internal + permission update_subscription = project->update_subscription + permission access_generate_commit_message = project->access_generate_commit_message + permission access_summarize_review = project->access_summarize_review + permission provide_status_check_response = project->provide_status_check_response + permission read_external_status_check_response = project->read_external_status_check_response + permission retry_failed_status_checks = project->retry_failed_status_checks +} + +// Epic resource (enhanced) +definition epic { + relation assignee: user + relation author: user + relation group: group + + permission admin_epic = group->admin_epic + author + permission create_epic = group->reporter + permission read_epic = group->read + permission update_epic = group->admin_epic + author + assignee + permission destroy_epic = group->owner + permission set_epic_metadata = group->reporter + permission set_epic_created_at = group->owner + permission set_epic_updated_at = group->owner + permission set_confidentiality = group->reporter + permission admin_epic_relation = group->developer + permission admin_epic_link_relation = group->developer + permission admin_epic_tree_relation = group->developer + permission create_epic_tree_relation = group->developer + permission read_epic_iid = group->read + permission read_epic_relation = group->read + permission read_epic_link_relation = group->read + permission create_note = group->create_note + permission read_note = group->read_note + permission admin_note = group->admin_note + permission award_emoji = group->award_emoji + permission create_todo = group->create_todo + permission mark_note_as_internal = group->mark_note_as_internal + permission measure_comment_temperature = group->measure_comment_temperature + permission read_issuable = group->read + permission read_issuable_participables = group->read + permission resolve_note = group->developer + permission summarize_comments = group->summarize_comments +} + +// Work item resource (enhanced) +definition work_item { + relation assignee: user + relation author: user + relation project: project + + permission admin_work_item = project->admin_issue + permission create_work_item = project->create_issue + permission read_work_item = project->read_project + permission update_work_item = project->admin_issue + author + assignee + permission delete_work_item = project->owner + permission clone_work_item = project->clone_work_item + permission move_work_item = project->move_work_item + permission set_work_item_metadata = project->set_work_item_metadata + permission admin_work_item_link = project->admin_work_item_link + permission admin_parent_link = project->admin_parent_link + permission report_spam = project->report_spam +} + +// Vulnerability resource (enhanced) +definition vulnerability { + relation author: user + relation finding: finding + relation project: project + + permission admin_vulnerability = project->admin_vulnerability + permission create_vulnerability_feedback = project->create_vulnerability_feedback + permission read_vulnerability = project->read_vulnerability + permission read_vulnerability_representation_information = project->read_vulnerability_representation_information + permission create_external_issue_link = project->create_external_issue_link +} + +// Finding resource (enhanced) +definition finding { + relation project: project + relation scanner: scanner + + permission admin_finding = project->admin_vulnerability + permission read_finding = project->read_vulnerability + permission read_finding_token_status = project->read_finding_token_status +} + +// Container repository resource (enhanced) +definition container_repository { + relation group: group + relation project: project + + permission admin_container_image = project->admin_container_image + permission destroy_container_image = project->admin_container_image + permission read_container_image = project->read_container_image + group->read_container_image + permission create_container_image = project->create_container_image + permission update_container_image = project->update_container_image + permission destroy_container_image_tag = project->destroy_container_image_tag +} + +// Package resource (enhanced) +definition package { + relation group: group + relation project: project + + permission admin_package = project->admin_package + group->admin_package + permission create_package = project->developer + permission destroy_package = project->admin_package + permission read_package = project->read_package + group->read_package + permission read_package_within_public_registries = project->read_package_within_public_registries + group->read_package_within_public_registries +} + +// Environment resource (enhanced) +definition environment { + relation deployment: deployment + relation project: project + + permission admin_environment = project->maintainer + permission read_environment = project->read_project + permission stop_environment = project->developer + permission create_environment = project->create_environment + permission update_environment = project->update_environment + permission destroy_environment = project->destroy_environment + permission create_environment_terminal = project->create_environment_terminal +} + +// Deployment resource (enhanced) +definition deployment { + relation author: user + relation environment: environment + relation project: project + + permission admin_deployment = project->maintainer + permission approve_deployment = project->maintainer + permission read_deployment = project->read_project + permission create_deployment = project->create_deployment + permission update_deployment = project->update_deployment + permission destroy_deployment = project->destroy_deployment + permission read_pages_deployments = project->read_pages_deployments + permission update_pages_deployments = project->update_pages_deployments +} + +// Member role resource (enhanced) +definition member_role { + relation group: group + relation organization: organization + + permission admin_member_role = group->owner + organization->admin + permission read_member_role = group->read + organization->read + permission delete_admin_role = organization->admin + permission read_admin_role = organization->admin + permission update_admin_role = organization->admin +} + +// Compliance framework resource (enhanced) +definition compliance_framework { + relation group: group + relation organization: organization + + permission admin_compliance_framework = group->admin_compliance_framework + organization->admin_compliance_framework + permission read_compliance_framework = group->read + organization->read + permission admin_compliance_pipeline_configuration = group->admin_compliance_pipeline_configuration +} + +// Audit event resource (enhanced) +definition audit_event { + relation group: group + relation project: project + relation organization: organization + + permission admin_external_audit_events = group->owner + organization->admin_external_audit_events + permission read_audit_event = group->owner + project->owner + organization->admin + permission read_admin_audit_log = organization->admin + permission admin_instance_external_audit_events = organization->admin + permission audit_event_definitions = organization->admin +} + +// Deploy token resource (enhanced) +definition deploy_token { + relation project: project + relation group: group + + permission read_registry = project->read_container_image + group->read_container_image + permission read_repository = project->read_code + group->read_code + permission write_registry = project->developer + group->developer + permission create_deploy_token = project->create_deploy_token + group->create_deploy_token + permission update_deploy_token = project->update_deploy_token + group->manage_deploy_tokens +} + +// Personal access token resource (enhanced) +definition personal_access_token { + relation user: user + relation organization: organization + + permission admin_token = user->user + organization->admin + permission use_token = user->user + organization->member + permission read_token = user->user + permission revoke_token = user->user + organization->admin + permission rotate_token = user->user +} + +// Scanner resource (enhanced) +definition scanner { + relation project: project + relation group: group + + permission admin_scanner = project->admin_vulnerability + group->admin_vulnerability + permission read_scanner = project->read_project + group->read + permission read_scan = project->read_scan +} + +// Note resource +definition note { + relation project: project + relation group: group + relation author: user + relation noteable_issue: issue + relation noteable_merge_request: merge_request + relation noteable_epic: epic + + permission read_note = project->read_note + group->read_note + author + permission admin_note = project->admin_note + group->admin_note + author + permission update_note = author + project->admin_note + group->admin_note + permission resolve_note = project->resolve_note + group->resolve_note + permission reposition_note = project->reposition_note + group->reposition_note + permission mark_note_as_internal = project->mark_note_as_internal + group->mark_note_as_internal + permission award_emoji = project->award_emoji + group->award_emoji +} + +// Todo resource +definition todo { + relation user: user + relation project: project + relation group: group + + permission read_todo = user + permission update_todo = user +} + +// Timelog resource +definition timelog { + relation project: project + relation group: group + relation user: user + + permission admin_timelog = project->admin_timelog + group->admin_timelog + permission create_timelog = project->create_timelog + group->create_timelog +} + +// Custom emoji resource +definition custom_emoji { + relation group: group + relation creator: user + + permission read_custom_emoji = group->read_custom_emoji + permission delete_custom_emoji = group->delete_custom_emoji + creator +} + +// Saved reply resource +definition saved_reply { + relation user: user + relation project: project + relation group: group + + permission create_saved_replies = user + project->create_saved_replies + group->create_saved_replies + permission read_saved_replies = user + project->read_saved_replies + group->read_saved_replies + permission update_saved_replies = user + project->update_saved_replies + group->update_saved_replies + permission destroy_saved_replies = user + project->destroy_saved_replies + group->destroy_saved_replies +} + +// Achievement resource +definition achievement { + relation namespace: group + relation user: user + + permission read_achievement = namespace->read_achievement + permission admin_achievement = namespace->admin_achievement + permission award_achievement = namespace->award_achievement + permission read_user_achievement = user + permission update_user_achievement = namespace->admin_achievement + permission update_owned_user_achievement = user + permission destroy_user_achievement = namespace->admin_achievement +} + +// Virtual registry resource +definition virtual_registry { + relation group: group + + permission read_virtual_registry = group->read_virtual_registry + permission create_virtual_registry = group->create_virtual_registry + permission update_virtual_registry = group->update_virtual_registry + permission destroy_virtual_registry = group->destroy_virtual_registry +} + +// Workspace resource +definition workspace { + relation project: project + relation user: user + + permission create_workspace = project->create_workspace + permission read_workspace = project->read_workspace + user + permission update_workspace = project->update_workspace + user + permission read_workspace_variable = project->read_workspace_variable + permission read_workspaces_agent_config = project->read_workspaces_agent_config + permission access_workspaces_feature = project->access_workspaces_feature + permission read_all_workspaces = project->owner +} + +// CRM contact resource +definition crm_contact { + relation group: group + + permission read_crm_contact = group->read_crm_contact + permission admin_crm_contact = group->admin_crm_contact +} + +// CRM organization resource +definition crm_organization { + relation group: group + + permission read_crm_organization = group->read_crm_organization + permission admin_crm_organization = group->admin_crm_organization +} + +// Custom field resource +definition custom_field { + relation project: project + relation group: group + + permission read_custom_field = project->read_custom_field + group->read_custom_field + permission admin_custom_field = project->admin_custom_field + group->admin_custom_field +} + +// Duo workflow resource +definition duo_workflow { + relation group: group + relation project: project + + permission admin_duo_workflow = group->admin_duo_workflow + permission read_duo_workflow = group->read_duo_workflow + project->duo_workflow + permission update_duo_workflow = group->update_duo_workflow + permission destroy_duo_workflow = group->destroy_duo_workflow + permission execute_duo_workflow_in_ci = group->execute_duo_workflow_in_ci + project->execute_duo_workflow_in_ci + permission read_duo_workflow_event = group->read_duo_workflow_event + project->read_duo_workflow_event +} + +// Group stage resource +definition group_stage { + relation group: group + + permission create_group_stage = group->create_group_stage + permission read_group_stage = group->read_group_stage + permission update_group_stage = group->update_group_stage + permission delete_group_stage = group->delete_group_stage +} + +// Resource access token resource +definition resource_access_token { + relation project: project + relation group: group + + permission read_resource_access_tokens = project->read_resource_access_tokens + group->read_resource_access_tokens + permission create_resource_access_tokens = project->create_resource_access_tokens + group->create_resource_access_tokens + permission destroy_resource_access_tokens = project->destroy_resource_access_tokens + group->destroy_resource_access_tokens + permission manage_resource_access_tokens = project->manage_resource_access_tokens + group->manage_resource_access_tokens +} + +// Cluster resource +definition cluster { + relation project: project + relation group: group + relation instance: organization + + permission read_cluster = project->read_cluster + group->read_cluster + instance->read + permission add_cluster = project->add_cluster + group->add_cluster + instance->admin + permission create_cluster = project->create_cluster + group->create_cluster + instance->admin + permission update_cluster = project->update_cluster + group->update_cluster + instance->admin + permission admin_cluster = project->admin_cluster + group->admin_cluster + instance->admin + permission read_cluster_environments = project->read_cluster_environments + group->read_cluster_environments + instance->read + permission use_k = project->use_k + group->use_k + instance->admin +} + +// Cluster agent resource +definition cluster_agent { + relation project: project + relation group: group + relation organization: organization + + permission read_cluster_agent = project->read_cluster_agent + group->read_cluster_agent + organization->read_organization_cluster_agent_mapping + permission admin_namespace_cluster_agent_mapping = group->admin_namespace_cluster_agent_mapping + permission admin_organization_cluster_agent_mapping = organization->admin_organization_cluster_agent_mapping + permission read_namespace_cluster_agent_mapping = group->read_namespace_cluster_agent_mapping + permission read_organization_cluster_agent_mapping = organization->read_organization_cluster_agent_mapping +} + +// Service account resource +definition service_account { + relation organization: organization + relation group: group + + permission admin_service_accounts = organization->admin_service_accounts + group->admin_service_accounts + permission create_service_account = organization->create_service_account + group->create_service_account + permission delete_service_account = organization->delete_service_account + group->delete_service_account + permission admin_service_account_member = group->admin_service_account_member +} + +// Import source user resource +definition source_user { + relation namespace: group + + permission admin_import_source_user = namespace->owner +} + +// Admin role resource +definition admin_role { + relation organization: organization + + permission read_admin_role = organization->admin + permission create_admin_role = organization->admin + permission update_admin_role = organization->admin + permission delete_admin_role = organization->admin +} + +// Terms resource +definition term { + relation user: user + + permission accept_terms = user + permission decline_terms = user +} + +// SAML provider resource +definition saml_provider { + relation group: group + + permission sign_in_with_saml_provider = group->guest_access + permission admin_group_saml = group->admin_group_saml + permission read_group_saml_identity = group->read_group_saml_identity + permission admin_saml_group_links = group->admin_saml_group_links + permission read_saml_user = group->read_saml_user +} + +// Thread resource (for conversations) +definition thread { + relation user: user + + permission delete_conversation_thread = user +} + +// Global resource for instance-wide permissions +definition global { + relation admin: user + relation user: user + + permission access_admin_area = admin + permission access_api = user + permission access_git = user + permission access_code_suggestions = user + permission access_duo_chat = user + permission access_duo_core_features = user + permission access_glab_ask_git_command = user + permission access_workspaces_feature = user + permission access_x_ray_on_instance = admin + permission admin_instance_external_audit_events = admin + permission admin_member_role = admin + permission admin_service_accounts = admin + permission admin_web_hook = admin + permission approve_user = admin + permission create_admin_role = admin + permission create_group = user + permission create_group_via_api = user + permission create_group_with_default_branch_protection = admin + permission create_instance_runner = admin + permission create_organization = admin + permission create_snippet = user + permission destroy_licenses = admin + permission execute_graphql_mutation = user + permission export_user_permissions = admin + permission log_in = user + permission manage_devops_adoption_namespaces = admin + permission manage_duo_core_settings = admin + permission manage_ldap_admin_links = admin + permission manage_self_hosted_models_settings = admin + permission manage_subscription = admin + permission read_admin_audit_log = admin + permission read_admin_background_jobs = admin + permission read_admin_background_migrations = admin + permission read_admin_cicd = admin + permission read_admin_gitaly_servers = admin + permission read_admin_health_check = admin + permission read_admin_metrics_dashboard = admin + permission read_admin_role = admin + permission read_admin_subscription = admin + permission read_admin_system_information = admin + permission read_admin_users = admin + permission read_all_geo = admin + permission read_all_workspaces = admin + permission read_application_statistics = admin + permission read_billable_member = admin + permission read_cloud_connector_status = admin + permission read_custom_attribute = admin + permission read_instance_metadata = admin + permission read_jobs_statistics = admin + permission read_licenses = admin + permission read_member_role = admin + permission read_operations_dashboard = admin + permission read_runner_upgrade_status = admin + permission read_runner_usage = admin + permission read_usage_trends_measurement = admin + permission read_users_list = admin + permission read_web_hook = admin + permission receive_notifications = user + permission reject_user = admin + permission update_custom_attribute = admin + permission update_max_pages_size = admin + permission use_project_statistics_filters = user + permission use_quick_actions = user + permission use_slash_commands = user + permission view_instance_devops_adoption = admin + permission view_member_roles = user + permission view_productivity_analytics = user + permission read_duo_core_settings = admin + permission read_self_hosted_models_settings = admin +}
\ No newline at end of file |