Available custom permissions

The following permissions are available. You can add these permissions in any combination to a base role to create a custom role.

Some permissions require having other permissions enabled first. For example, administration of vulnerabilities (admin_vulnerability) can only be enabled if reading vulnerabilities (read_vulnerability) is also enabled.

These requirements are documented in the Required permission column in the following table.

Code review workflow

Name	Required permission	Description	Introduced in	Feature flag	Enabled in
`admin_merge_request`		Allows approval of merge requests.	GitLab 16.4
`read_code`		Allows read-only access to the source code.	GitLab 15.7	`customizable_roles`	GitLab 15.9

Group and projects

Name	Required permission	Description	Introduced in	Feature flag	Enabled in
`admin_group_member`		Allows admin of group members.	GitLab 16.5	`admin_group_member`	GitLab 16.6

Groups and projects

Name	Required permission	Description	Introduced in	Feature flag	Enabled in
`archive_project`		Allows archiving of projects.	GitLab 16.6	`archive_project`	GitLab 16.7
`remove_project`		Allows deletion of projects.	GitLab 16.8

Infrastructure as code

Name	Required permission	Description	Introduced in	Feature flag	Enabled in
`admin_terraform_state`		Allows to admin terraform state	GitLab 16.8

System access

Name	Required permission	Description	Introduced in	Feature flag	Enabled in
`manage_group_access_tokens`		Allows manage access to the group access tokens.	GitLab 16.8
`manage_project_access_tokens`		Allows manage access to the project access tokens.	GitLab 16.5	`manage_project_access_tokens`	GitLab 16.8

Vulnerability management

Name	Description	Introduced in
`admin_vulnerability`	Allows admin access to the vulnerability reports.	GitLab 16.1
`read_dependency`	Allows read-only access to the dependencies.	GitLab 16.3
`read_vulnerability`	Allows read-only access to the vulnerability reports.	GitLab 16.1