• Roles
• Project members permissions
  • Application Security
  • Compliance
  • Machine learning model registry and experiments
  • Project planning
  • Packages and Registries
  • Repository
  • GitLab CI/CD permissions
    • Job permissions
  • GitLab Duo
• Group members permissions
  • Application Security
  • Compliance
  • Project planning
  • Packages and Registries
  • Repository
  • Subgroup permissions
  • GitLab Duo
• Users with Minimal Access
  • Minimal access users receive 404 errors
• Related topics

Permissions and roles

When you add a user to a project or group, you assign them a role. The role determines which actions they can take in GitLab.

If you add a user to both a project’s group and the project itself, the higher role is used.

GitLab administrators have all permissions.

Roles

You can assign users a default role or a custom role.

The available default roles are:

• Guest (This role applies to private and internal projects only.)
• Reporter
• Developer
• Maintainer
• Owner
• Minimal Access (available for the top-level group only)

A user assigned the Guest role has the least permissions, and the Owner has the most.

By default, all users can create top-level groups and change their usernames. A GitLab administrator can change this behavior for the GitLab instance.

Project members permissions

A user’s role determines what permissions they have on a project. The Owner role provides all permissions but is available only:

• For group and project Owners.
• For Administrators.

Personal namespace owners:

• Are displayed as having the Maintainer role on projects in the namespace, but have the same permissions as a user with the Owner role.
• For new projects in the namespace, are displayed as having the Owner role.

For more information about how to manage project members, see members of a project.

The following table lists project permissions available for each role:

Application Security

Project permissions for application security features including dependency management, security analyzers, security policies, and vulnerability management.

Compliance

Project permissions for compliance features including compliance center, audit events, compliance frameworks, and licenses.

Machine learning model registry and experiments

Project permissions for model registry and model experiments.

Project planning

Project permissions for issues:

Project permissions for tasks:

Project permissions for OKRs:

Project permissions for wikis:

Packages and Registries

Project permissions for container registry:

Project permissions for package registry:

Repository

Project permissions for repository features including source code, branches, push rules, and more:

Project permissions for merge requests:

GitLab CI/CD permissions

GitLab CI/CD permissions for some roles can be modified by these settings:

• Public pipelines: When set to public, gives access to certain CI/CD features to Guest project members.
• Pipeline visibility: When set to Everyone with Access, gives access to certain CI/CD “view” features to non-project members.

Project Owners can do any listed action, and also can delete pipelines:

Job permissions

This table shows granted privileges for jobs triggered by specific roles.

Project Owners can do any listed action, but no users can push source and LFS together. Guest users and members with the Reporter role cannot do any of these actions.

GitLab Duo

Project permissions for GitLab Duo:

Group members permissions

Any user can remove themselves from a group, unless they are the last Owner of the group.

The following table lists group permissions available for each role:

Application Security

Group permissions for Application Security features including dependency management, security analyzers, security policies, and vulnerability management.

Compliance

Groups permissions for compliance features including compliance center, audit events, compliance frameworks, and licenses.

Project planning

Group permissions for project planning features including iterations, milestones, and labels:

Group permisisons for epics:

Group permissions for wikis:

Packages and Registries

Group permissions for container registry:

Group permissions for package registry:

Repository

Group permissions for repository features including merge requests, push rules, and deploy tokens.

Subgroup permissions

When you add a member to a subgroup, they inherit the membership and permission level from the parent groups. This model allows access to nested groups if you have membership in one of its parents.

For more information, see subgroup memberships.

GitLab Duo

Group permissions for GitLab Duo:

Users with Minimal Access

Users with the Minimal Access role do not:

• Automatically have access to projects and subgroups in that root group.
• Count as licensed seats on self-managed Ultimate subscriptions or any GitLab.com subscriptions, provided the user has no other role anywhere in the instance or in the GitLab.com namespace.

Owners must explicitly add these users to the specific subgroups and projects.

You can use the Minimal Access role with SAML SSO for GitLab.com groups to control access to groups and projects in the group hierarchy. You can set the default role to Minimal Access for members automatically added to the root group through SSO.

1. On the left sidebar, select Search or go to and find your group.
2. Select Settings > SAML SSO.
3. From the Default membership role dropdown list, select Minimal Access.
4. Select Save changes.

Minimal access users receive 404 errors

Because of an outstanding issue, when a user with the Minimal Access role:

• Signs in with standard web authentication, they receive a 404 error when accessing the parent group.
• Signs in with Group SSO, they receive a 404 error immediately because they are redirected to the parent group page.

To work around the issue, give these users the Guest role or higher to any project or subgroup in the parent group. Guest users consume a license seat in the Premium tier but do not in the Ultimate tier.

Related topics

• Custom roles
• The GitLab principles behind permissions
• Members
• Customize permissions on protected branches
• LDAP user permissions
• Value stream analytics permissions
• Project aliases
• Auditor users
• Confidential issues
• Container registry permissions
• Release permissions
• Read-only namespaces