Available custom permissions

The following permissions are available. You can add these permissions in any combination to a base role to create a custom role.

Some permissions require having other permissions enabled first. For example, administration of vulnerabilities (admin_vulnerability) can only be enabled if reading vulnerabilities (read_vulnerability) is also enabled.

These requirements are documented in the Required permission column in the following table.

Code review workflow

Name Required permission Description Introduced in Feature flag Enabled in
admin_merge_request   Allows approval of merge requests. GitLab 16.4    
read_code   Allows read-only access to the source code. GitLab 15.7 customizable_roles GitLab 15.9

Group and projects

Name Required permission Description Introduced in Feature flag Enabled in
admin_group_member   Add or remove users in a group, and assign roles to users. When assigning a role, users with this custom permission must select a role that has the same or fewer permissions as the default role used as the base for their custom role. GitLab 16.5 admin_group_member GitLab 16.6

Groups and projects

Name Required permission Description Introduced in Feature flag Enabled in
archive_project   Allows archiving of projects. GitLab 16.6 archive_project GitLab 16.7
remove_group   Ability to delete or restore a group. This ability does not allow deleting top level groups. Review the Retention period settings to prevent accidental deletion. GitLab 16.10    
remove_project   Allows deletion of projects. GitLab 16.8    

Infrastructure as code

Name Required permission Description Introduced in Feature flag Enabled in
admin_terraform_state   Execute terraform commands, lock/unlock terraform state files, and remove file versions. GitLab 16.8    

Secrets management

Name Required permission Description Introduced in Feature flag Enabled in
admin_cicd_variables   Create, read, update, and delete CI/CD variables. GitLab 16.10    

Security policy management

Name Required permission Description Introduced in Feature flag Enabled in
manage_security_policy_link   Allows assigning security policy projects. GitLab 16.11    

Source code management

Name Required permission Description Introduced in Feature flag Enabled in
admin_push_rules   Configure push rules for repositories at the group or project level. GitLab 16.11 custom_ability_admin_push_rules  

System access

Name Required permission Description Introduced in Feature flag Enabled in
manage_group_access_tokens   Create, read, update, and delete group access tokens. When creating a token, users with this custom permission must select a role for that token that has the same or fewer permissions as the default role used as the base for the custom role. GitLab 16.8    
manage_project_access_tokens   Create, read, update, and delete project access tokens. When creating a token, users with this custom permission must select a role for that token that has the same or fewer permissions as the default role used as the base for the custom role. GitLab 16.5 manage_project_access_tokens GitLab 16.8

Vulnerability management

Name Required permission Description Introduced in Feature flag Enabled in
admin_vulnerability   Edit the vulnerability object, including the status and linking an issue. Includes the read_vulnerability permission actions. GitLab 16.1    
read_dependency   Allows read-only access to the dependencies and licenses. GitLab 16.3    
read_vulnerability   Read vulnerability reports and security dashboards. GitLab 16.1