Permissions Reference
The platform uses a permission system where each permission is a checkbox you can toggle when creating roles, adding members, or configuring audiences. Permissions are organized into categories and displayed with descriptive labels.
Permission Resolution
When the platform checks if an action is allowed, it evaluates in this order:
- Owner — Repository owners automatically have full access.
- Individual permissions — Direct permission grants to a specific member.
- Role-based permissions — Permissions inherited from assigned roles.
- Group-based permissions — Permissions inherited from group membership.
- Audience permissions — Broad permissions based on public/member/anonymous/owner audience.
- Default: Deny — If no permission grants the action, it is denied.
Audience Types
Audiences set broad permissions based on who is accessing the repository:
- Owner — The repository owner or account. Controls what the owner can do on their own resources.
- Member — Any authenticated user who is a member of the repository.
- Public — Any authenticated user on the platform, even if they are not a member.
- Anonymous — Unauthenticated users visiting the platform.
Default Permissions
When a repository is created, these permissions are enabled by default:
- Public audience: Read Repository and Read Ref.
- Anonymous audience: No permissions enabled.
Repository
Core permissions for the repository itself.
| Permission | Description |
|---|---|
| Allow Child Repository | Allows creating child repositories (forks / sub-repositories). |
| Read Repository | Allows reading (pulling) from repository. |
| Write Repository | Allows writing (pushing) to repository. |
| Delete Repository | Allows deleting the repository. |
| Edit Repository Settings | Allows editing of repository settings. |
| Read Repository Settings | Allows reading of repository settings. |
| Private Repository Email | Prevents repository set emails from being read. |
Ref
Control operations on branches, tags, and other Git refs.
| Permission | Description |
|---|---|
| Create Ref | Allow creating new branches or tags. |
| Read Ref | Set default read (pull) access for refs. |
| Write Ref | Set default write (push) access for refs. |
| Merge Ref | Set default merge refs permission. |
| Force Push Ref | Set default force push refs permission. |
| Delete Ref | Set default delete refs permission. |
Ref Policies
Control who can manage branch protection rules.
| Permission | Description |
|---|---|
| Reading Ref Policy | Allows seeing ref protection policies. |
| Add Ref Policy | Allows adding ref protection policies. |
| Edit Ref Policy | Allows editing ref protection policies. |
| Delete Ref Policy | Allows deleting ref protection policies. |
Change Requests
Control the change request (pull request) lifecycle.
| Permission | Description |
|---|---|
| Create Change Request | Allows creating new change requests to propose merging branches. |
| Read Change Request | Allows reading change requests. |
| Edit Change Request | Allows editing change requests. |
| Delete Change Request | Allows deleting change requests. |
| Close Change Request | Allows closing change requests without merging. |
| Merge Change Request | Allows merging change requests into the target branch. |
| Force Merge Change Request | Allows force merging change requests even when requirements are not met. |
| Approve Change Request | Allows approving change requests. |
| Review Change Request | Allows reviewing change requests. |
| Edit CR Approval Settings | Allows editing approval settings on change requests. |
Reviewers
Control who can manage reviewer assignments on change requests.
| Permission | Description |
|---|---|
| Add Reviewer | Allows adding reviewers to change requests. |
| Edit Reviewer | Allows editing reviewers on change requests. |
| Remove Reviewer | Allows removing reviewers from change requests. |
| Read Reviewers | Allows seeing reviewers on change requests. |
Assignees
Control who can manage assignee assignments on change requests.
| Permission | Description |
|---|---|
| Add Assignee | Allows adding assignees to change requests. |
| Edit Assignee | Allows editing assignees on change requests. |
| Remove Assignee | Allows removing assignees from change requests. |
| Read Assignees | Allows seeing assignees on change requests. |
Threads
Control who can manage discussion threads on change requests.
| Permission | Description |
|---|---|
| Create Thread | Allows creating new discussion threads (comments, issues, or suggestions) on a change request. |
| Edit Thread | Allows editing existing thread messages. |
| Delete Thread | Allows deleting threads or messages. |
| Read Threads | Allows reading threads on change requests. |
| Close Thread | Allows closing threads on change requests. |
| Resolve Thread | Allows resolving threads on change requests (required for merge when thread resolution is enforced). |
CR Policies
Control who can manage automated change request policies.
| Permission | Description |
|---|---|
| Read CR Policy | Allows seeing change request policies. |
| Add CR Policy | Allows adding change request policies. |
| Edit CR Policy | Allows editing change request policies. |
| Delete CR Policy | Allows deleting change request policies. |
Review Policies
Control who can manage auto-assignment reviewer rules.
| Permission | Description |
|---|---|
| Read Review Policy | Allows seeing change request reviewer policies. |
| Add Review Policy | Allows adding change request reviewer policies. |
| Edit Review Policy | Allows editing change request reviewer policies. |
| Delete Review Policy | Allows deleting change request reviewer policies. |
Repository Audiences
Control who can manage audience permission settings.
| Permission | Description |
|---|---|
| Read Repository Audiences | See repository audiences permissions. |
| Add Repository Audiences | Add audiences to repository. |
| Edit Repository Audiences | Edit repository audiences permissions. |
| Remove Repository Audiences | Remove audiences from repository. |
Repository Members
Control who can manage repository membership.
| Permission | Description |
|---|---|
| Read Repository Member | See repository members. |
| Add Repository Member | Add members to repository. |
| Edit Repository Member | Edit repository members. |
| Remove Repository Member | Remove members from repository. |
Repository Roles
Control who can manage repository roles.
| Permission | Description |
|---|---|
| Read Repository Role | See repository roles. |
| Add Repository Role | Add repository roles. |
| Edit Repository Role | Edit repository roles. |
| Delete Repository Role | Delete repository roles. |
Repository Groups
Control who can manage repository groups.
| Permission | Description |
|---|---|
| Read Repository Group | See repository groups. |
| Add Repository Group | Add groups to repository. |
| Edit Repository Group | Edit repository groups. |
| Remove Repository Group | Remove groups from repository. |
Secrets
Control who can manage CI/CD secrets.
| Permission | Description |
|---|---|
| Read Secrets | See repository secrets. |
| Add Secret | Add repository secrets. |
| Delete Secret | Delete repository secrets. |
CI/CD
Control access to CI/CD pipelines and logs.
| Permission | Description |
|---|---|
| Run CICD | Run CICD pipelines. |
| Read CICD | Read CICD jobs. |
| Read CICD Logs | Read CICD job logs. |
| Delete CICD Job | Delete CICD jobs. |
| Delete CICD Logs | Delete CICD job logs. |
Billing
Control who pays for resource usage.
| Permission | Description |
|---|---|
| Bill Network Costs to Users (Public Read) | If enabled, users who pull/clone pay network costs. If disabled, the repository owner pays. |
| Bill CICD Costs to Users (Public Read) | If enabled, users will pay for CICD jobs they start. If disabled, the repository owner pays. |
Repository Settings
Configurable values that control repository defaults. These appear in the repository settings edit form.
| Setting | Type | Default | Description |
|---|---|---|---|
| Default Branch Name | Text | master | The default branch name created when initializing a new repository. |
| CICD Config Files | Text | .project113/ | The file or directory the platform reads for CI/CD pipeline configuration. |
| CICD Data Retention Days | Number | 60 | Number of days to retain CI/CD job metadata before automatic cleanup. |
| CICD Logs Retention Days | Number | 30 | Number of days to retain CI/CD job logs before automatic cleanup. |
Change Request Defaults
Configurable values that control change request behavior. These appear in the repository settings edit form and CR policy modals.
| Setting | Type | Default | Description |
|---|---|---|---|
| Merge Strategy | Select | merge | Default merge strategy for new CRs. Options: merge, squash, rebase. |
| Sync Strategy | Select | merge | How CRs stay up to date with the target branch. Options: manual, merge, rebase. |
| Auto Delete Source Branch | Checkbox | off | Automatically delete the source branch after a CR is merged. |
| Auto Retarget | Checkbox | off | Automatically retarget dependent CRs when the target branch of a CR changes. |
| Require CI Pass | Checkbox | off | Block merging until all CI pipelines succeed. |
| Minimum Approvals | Number | 0 | Minimum number of approving reviews required before merging. |
| All Threads Resolved | Checkbox | off | Block merging until all discussion threads are resolved. |
| Allow Force Merge | Checkbox | on | Allow merging even when approval or CI requirements are not met. |
| Auto Merge | Checkbox | off | Automatically merge the CR when all conditions are satisfied. |
| Use CR Title | Checkbox | off | Use the change request title as the merge commit message. |
| Custom Commit Message | Text | (empty) | Custom default commit message template for merges. |
| Use Random CR IDs | Checkbox | off | Generate random change request identifiers instead of sequential numbers. |