Permission Matrix Overview
The permission matrix for system roles is fixed and cannot be modified. This document lists all configurable permission points in a hierarchical manner for creating or editing custom roles.
For the complete creation process of custom roles, please refer to Custom Role Configuration.
I. Enterprise-Level Permission Points
| Resource | Permission Points | Description |
|---|---|---|
| Enterprise Milestones | View, Create, Update, Delete | Full lifecycle management of enterprise-level milestones |
| Enterprise Webhook | View, Create, Update, Delete | Full lifecycle management of enterprise-level Webhooks |
The enterprise edition is currently in internal testing, and enterprise-level permission points will continue to be supplemented and improved.
II. Organization-Level Permission Points
| Resource | Permission Points | Description |
|---|---|---|
| Organization | Settings | Setting of basic organization information |
| Project | Create | Permission to create projects within the organization |
| Comment | Create, Update, Delete | Management of comments within the organization |
| Discussion | Create, Update, Pin, Post Announcement, Close/Reopen, Lock, Delete | Multi-dimensional management of organization discussions |
| Board | Update, Close/Reopen | Management of organization boards |
| Spaces | Update, Settings, Activate, Pause, Reset, Logs | Full lifecycle management of Spaces |
| Collection | Create, Update, Delete | Management of collections |
III. Project-Level Permission Points
| Resource | Permission Points | Description |
|---|---|---|
| Project | Settings, Fork | Project settings and fork permissions |
| Code | Download, Push | Permissions for downloading and pushing code |
| Wiki | Download, Push | Access and editing of Wiki |
| Issue | Create, Update, Transfer, Pin, Lock, Close/Reopen, Delete | Full lifecycle management of Issues |
| Label | Create, Update, Delete | Management of project labels |
| Milestone | Create, Update, Delete | Management of milestones |
| Branch | Create, Delete | Management of branches |
| Tag | Create, Delete | Management of tags |
| Pull Request | Create, Update, Review, Evaluate, Merge, Test, Close, Reopen | Full lifecycle management of PRs |
| Comment | Create, Update, Resolve, Delete | Comments and Code Review resolution |
| Pipeline | Create, Update, Run, Rerun, Delete | Full lifecycle management of pipelines |
| Discussion | Create, Update, Pin, Post Announcement, Close/Reopen, Lock, Delete | Multi-dimensional management of discussions |
IV. Permission Dependencies
When configuring a custom role, there are dependencies between the following permission points, and the system will automatically check the dependent items:
| Permission | Dependent Resource | Dependent Permission |
|---|---|---|
| Tag Create | Code | Push + Download |
| Tag Delete | Code | Push + Download |
| Code Push | Code | Download |
| Project Fork | Code | Download |
| PR Merge | Code | Push |
| Board Update | Issue + PR | Update |
| Branch Create | Code | Push + Download |
| Branch Delete | Code | Push + Download |
| Milestone Update | Issue + PR | Update |
V. System Role Reference
The permissions of system roles are pre-set by the system and cannot be modified.
| Role | Description |
|---|---|
| Administrator | Enterprise, organization, or project administrator, with all permissions and final decision-making power |
| Maintainer | Project or organization maintainer, responsible for daily maintenance tasks such as handling issues and PRs |
| Developer | Write and submit code, participate in development and discussions |
| Contributor | Report issues, provide feedback, participate in project discussions |
| Viewer | Browse project permissions, participate in discussions in public discussion areas |
Additional Notes
- The creator of an Issue and PR can update its title and description, and also close or reopen it.
- The author of a comment can edit and update their own comment.
- Security Issues can only be viewed by the author and project members.
- The release version permission of a project is consistent with the tag permission.