Roles and permissions | GitLab Docs Skip to main content Go to GitLab Docs homepage What's new? What's new? Get free trial Toggle menu * Use GitLab * GitLab Duo * GitLab Orbit * Extend * Install * Administer * Subscribe * Contribute * Solutions Getting started Tutorials Manage your organization Organize work with projects Plan and track work Manage authentication and authorization User identity User authentication User permissions Auditor users External users Guest role Internal users Enterprise users Participants Service accounts Roles and permissions Custom roles Custom permissions Auth best practices Auth glossary Use Git Manage your code Use CI/CD to build your application Secure your application Deploy and release your application Manage your infrastructure Monitor your application Analyze GitLab usage Release notes Feature support Find your GitLab version * GitLab Docs / * Use GitLab / * Manage authentication an… / * User permissions / * Roles and permissions Help us learn about your current experience with the documentation. Take the survey . Roles and permissions * Tier : Free, Premium, Ultimate * Offering : GitLab.com, GitLab Self-Managed, GitLab Dedicated Roles define a user s permissions in a group or project. Users with administrator access have all permissions and can perform any action. Roles History * Planner role introduced in GitLab 17.7. * Security Manager role introduced as a beta in GitLab 18.11. Disabled by default. * Enabled on GitLab.com in GitLab 18.11. When you add a user to a group or project, you assign them a role. The role determines their permissions. Assign either a default role or a custom role . A user can have different roles for each group and project. Users always retain the permissions for their highest role. For example, if a user has: * The Maintainer role for a parent group * The Developer role for a project in that group The user inherits the permissions for their Maintainer role in the project. To view assigned roles, go to the Members page for a group or project . Default roles Roles are ordered from the fewest permissions to the most. The Guest, Reporter, Developer, Maintainer, and Owner roles are cumulative, so each role includes most of the permissions of the roles before it. The Planner and Security Manager roles are specialized for planning and security work, so they do not include all the permissions of the other roles. To confirm whether a role has a specific permission, check the relevant table. The following default roles are available: Role Description Minimal Access View limited group information without access to projects. For more information, see users with Minimal Access . Guest View and comment on issues and epics. Cannot push code or access repository. This role applies to private and internal projects only. Planner Create and manage issues, epics, milestones, and iterations. Focused on project planning and tracking with the ability to view and collaborate on code changes. Reporter View code, create issues, and generate reports. Cannot push code or manage protected branches. Security Manager View and manage security vulnerabilities, compliance configurations, and audit events. Focused on security operations without code push access. Developer Push code to non-protected branches, create merge requests, and run CI/CD pipelines. Cannot manage project settings. Maintainer Manage branches, merge requests, CI/CD settings, and project members. Cannot delete the project. Owner Full control over the project or group, including deletion and visibility settings. By default, all users can create top-level groups and change their usernames. Users with administrator access can change this behavior. Group permissions Any user can remove themselves from a group, unless they are the only Owner of the group. The following table lists the group permissions available for each role. The Minimal Access role is not included because it has no permissions. Groups Group permissions for group features : Action Guest Planner Reporter Security Manager Developer Maintainer Owner Browse group ✓ ✓ ✓ ✓ ✓ ✓ ✓ Search projects in group ✓ ✓ ✓ ✓ ✓ ✓ ✓ Search subgroups in group ✓ ✓ ✓ ✓ ✓ ✓ ✓ View group audit events 1 ✓ ✓ ✓ ✓ Create project in group 2 ✓ ✓ ✓ Create subgroup 3 ✓ ✓ Change custom settings for project integrations ✓ Edit epic comments (posted by any user) ✓ ✓ Fork project into a group ✓ ✓ View Billing 4 ✓ View group Usage quotas page 4 ✓ Migrate group ✓ Archive group ✓ Delete group ✓ Transfer group ✓ Manage subscriptions, storage, and compute minutes ✓ Manage group access tokens ✓ Change group visibility level ✓ Edit group settings ✓ Configure project templates ✓ Configure SAML SSO 4 ✓ Disable notification emails ✓ Import project ✓ ✓ Footnotes : * Developers and Maintainers can view events based on their individual actions only. For more information, see the prerequisites . * Developers, Maintainers, and Owners: Only if the project creation role is set for the instance or for the group . Developers: Developers can push commits to the default branch of a new project only if the default branch protection is set to Partially protected or Not protected . * Maintainers: Only if users with the Maintainer role can create subgroups . * Does not apply to subgroups. Group analytics Group permission for analytics features including value streams, product analytics, and insights: Action Guest Planner Reporter Security Manager Developer Maintainer Owner View GitLab Duo and SDLC trends ✓ ✓ ✓ ✓ ✓ View insights ✓ ✓ ✓ ✓ ✓ ✓ ✓ View insights charts ✓ ✓ ✓ ✓ ✓ ✓ ✓ View issue analytics ✓ ✓ ✓ ✓ ✓ ✓ ✓ View contribution analytics ✓ ✓ ✓ ✓ ✓ ✓ ✓ View value stream analytics ✓ ✓ ✓ ✓ ✓ View productivity analytics ✓ ✓ ✓ ✓ ✓ View group DevOps adoption ✓ ✓ ✓ ✓ ✓ View metrics dashboard annotations ✓ ✓ ✓ ✓ ✓ Manage metrics dashboard annotations ✓ ✓ ✓ Group application security Group permissions for Application Security features including dependency management, security analyzers, security policies, and vulnerability management. Action Guest Planner Reporter Security Manager Developer Maintainer Owner View dependency list ✓ ✓ ✓ ✓ View vulnerability report ✓ ✓ ✓ ✓ View security dashboard ✓ ✓ ✓ ✓ Create security policy project ✓ ✓ Assign security policy project ✓ ✓ Group Secrets Manager Group permissions for GitLab Secrets Manager : Action Guest Planner Reporter Security Manager Developer Maintainer Owner Enable GitLab Secrets Manager 1 ✓ Manage permissions for secrets ✓ Read secret metadata ✓ Create, update, and delete secrets 2 ✓ Read secret value 3 Footnotes : * On GitLab.com, only a top level group Owner can enable Secrets Manager for subgroups and projects. On self-managed, an administrator must enable it for the instance. * Owners can grant this action to other roles, specific users, groups, or custom roles. See Manage secrets permissions . * No role can read a secret s value. CI/CD jobs read values through job authentication. Other workloads read values through the Secrets Manager API , and only if they have been granted the read value permission for that secret. Group CI/CD Group permissions for CI/CD features including runners, variables, and protected environments: Action Guest Planner Reporter Security Manager Developer Maintainer Owner View instance runner ✓ ✓ ✓ ✓ ✓ ✓ ✓ View group runners ✓ ✓ Manage group-level Kubernetes cluster ✓ ✓ Manage group runners ✓ Manage group level CI/CD variables ✓ Manage group protected environments ✓ Group compliance Group permissions for compliance features including compliance center, audit events, compliance frameworks, and licenses. Action Guest Planner Reporter Security Manager Developer Maintainer Owner View audit events 1 ✓ ✓ ✓ ✓ View licenses in dependency list ✓ ✓ ✓ ✓ View compliance center ✓ ✓ Manage compliance frameworks ✓ ✓ Assign compliance frameworks to projects ✓ ✓ Manage audit streams ✓ ✓ Footnotes : * Users can view events based on their individual actions only. For more details, see the prerequisites . Group GitLab Duo Group permissions for GitLab Duo : Action Non-member Guest Planner Reporter Security Manager Developer Maintainer Owner Use GitLab Duo features 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Configure GitLab Duo feature availability ✓ ✓ Configure GitLab Duo Self Hosted ✓ Enable beta and experimental features ✓ Purchase GitLab Duo seats ✓ Footnotes : * If the user has GitLab Duo Pro or Enterprise, the user must be assigned a seat to gain access to that GitLab Duo add-on . If the user has GitLab Duo Core, there are no other requirements. Group packages and registries Group permissions for the package and container registry : Action Guest Planner Reporter Security Manager Developer Maintainer Owner Pull container registry images 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Pull container images with the dependency proxy ✓ ✓ ✓ ✓ ✓ ✓ ✓ Delete container registry images ✓ ✓ ✓ Configure a virtual registry ✓ ✓ Pull an artifact from a virtual registry ✓ ✓ ✓ ✓ ✓ ✓ Footnotes : * Guests can only view events based on their individual actions. Group permissions for package registry : Action Guest Planner Reporter Security Manager Developer Maintainer Owner Pull packages ✓ ✓ ✓ ✓ ✓ Publish packages ✓ ✓ ✓ Delete packages ✓ ✓ Manage package settings ✓ Manage dependency proxy cleanup policies ✓ Enable dependency proxy ✓ Disable dependency proxy ✓ Purge the group dependency proxy ✓ Enable package request forwarding ✓ Disable package request forwarding ✓ Group planning Action Guest Planner Reporter Security Manager Developer Maintainer Owner View epic ✓ ✓ ✓ ✓ ✓ ✓ ✓ Search epics 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Add issues to an epic 2 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Add child epics 3 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Add parent epic 4 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Add internal notes ✓ ✓ ✓ ✓ ✓ ✓ Create epics ✓ ✓ ✓ ✓ ✓ ✓ Update epic details ✓ ✓ ✓ ✓ ✓ ✓ Manage epic boards ✓ ✓ ✓ ✓ ✓ ✓ Delete epics 5 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Footnotes : * You must have permission to view the epic . * You must have permission to view the epic and edit the issue. * You must have permission to view the parent and child epics. * You must have permission to view the parent epic. * Users who don t have the Planner or Owner role can only delete the epics they authored. Group permissions for wikis : Action Guest Planner Reporter Security Manager Developer Maintainer Owner View group wiki 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Search group wikis 2 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Create group wiki pages ✓ ✓ ✓ ✓ Edit group wiki pages ✓ ✓ ✓ ✓ Delete group wiki pages ✓ ✓ ✓ ✓ Footnotes : * Guests: In addition, if your group is public or internal, all users who can see the group can also see group wiki pages. * Guests: In addition, if your group is public or internal, all users who can see the group can also search group wiki pages. Group repositories Group permissions for repository features including merge requests, push rules, and deploy tokens. Action Guest Planner Reporter Security Manager Developer Maintainer Owner Manage deploy tokens ✓ Manage merge request settings ✓ Manage push rules ✓ Group user management Group permissions for user management: Action Guest Planner Reporter Security Manager Developer Maintainer Owner View 2FA status of members ✓ Filter members by 2FA status ✓ Manage group members ✓ Manage group-level custom roles ✓ Share (invite) groups to groups ✓ Group workspaces Groups permissions for workspaces: Action Guest Planner Reporter Security Manager Developer Maintainer Owner View workspace cluster agents mapped to a group ✓ ✓ Map or unmap workspace cluster agents to and from a group ✓ Project permissions A user s role determines what permissions they have on a project. The Owner role provides all permissions but is available only: * For group and project Owners. * For Administrators. Personal namespace owners: * Are displayed as having the Maintainer role on projects in the namespace, but have the same permissions as a user with the Owner role. * For new projects in the namespace, are displayed as having the Owner role. When you configure protected branch settings , selecting a role grants access to users with that role and all higher roles. For example, if you select Maintainers in the protected branch settings, users with both the Maintainer and Owner roles can perform the action. For more information about how to manage project members, see members of a project . The following table lists the project permissions available for each role. The Minimal Access role is not included because it has no permissions. Projects Project permissions for project features : Action Guest Planner Reporter Security Manager Developer Maintainer Owner Download project 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ Leave comments ✓ ✓ ✓ ✓ ✓ ✓ ✓ Reposition comments on images (posted by any user) 2 ✓ ✓ ✓ ✓ ✓ ✓ ✓ View insights ✓ ✓ ✓ ✓ ✓ ✓ ✓ View requirements ✓ ✓ ✓ ✓ ✓ ✓ ✓ View time tracking reports 1 ✓ ✓ ✓ ✓ ✓ ✓ ✓ View snippets ✓ ✓ ✓ ✓ ✓ ✓ ✓ Search snippets and comments ✓ ✓ ✓ ✓ ✓ ✓ ✓ View project traffic statistics ✓ ✓ ✓ ✓ ✓ Create snippets ✓ ✓ ✓ ✓ ✓ View releases 3 ✓ ✓ ✓ ✓ ✓ ✓ Manage releases 4 ✓ ✓ Configure webhooks ✓ ✓ Manage project access tokens 5 ✓ ✓ Export project ✓ ✓ Rename project ✓ ✓ Edit project badges ✓ ✓ Edit project settings ✓ ✓ Change project features visibility level 6 ✓ ✓ Change custom settings for project integrations ✓ ✓ Edit comments posted by other users ✓ ✓ Add deploy keys ✓ ✓ Manage project operations ✓ ✓ View Usage quotas page ✓ ✓ Globally delete snippets ✓ ✓ Globally edit snippets ✓ ✓ Archive project ✓ Change project visibility level ✓ Delete project ✓ Disable notification emails ✓ Transfer project ✓ Footnotes : * On GitLab Self-Managed, users with the Guest role are able to perform this action only on public and internal projects (not on private projects). External users must be given explicit access (at least the Reporter role) even if the project is internal. Users with the Guest role on GitLab.com are only able to perform this action on public projects because internal visibility is not available. * Applies only to comments on Design Management designs. * Guest users can access GitLab Releases for downloading assets but are not allowed to download the source code nor see repository information like commits and release evidence . * If the tag is protected , this depends on the access given to Developers and Maintainers. * For GitLab Self-Managed, project access tokens are available in all tiers. For GitLab.com, project access tokens are supported in the Premium and Ultimate tier (excluding trial licenses ). * A Maintainer or Owner can t change project features visibility level if project visibility is set to private. Project permissions for GitLab Pages : Action Guest Planner Reporter Security Manager Developer Maintainer Owner View GitLab Pages protected by access control ✓ ✓ ✓ ✓ ✓ ✓ ✓ Manage GitLab Pages ✓ ✓ Manage GitLab Pages domain and certificates ✓ ✓ Remove GitLab Pages ✓ ✓ Project analytics Project permissions for analytics features including value streams, usage trends, product analytics, and insights. Action Guest Planner Reporter Security Manager Developer Maintainer Owner View issue analytics ✓ ✓ ✓ ✓ ✓ ✓ ✓ View value stream analytics ✓ ✓ ✓ ✓ ✓ View CI/CD analytics ✓ ✓ ✓ ✓ ✓ View code review analytics ✓ ✓ ✓ ✓ ✓ View DORA metrics ✓ ✓ ✓ ✓ ✓ View merge request analytics ✓ ✓ ✓ ✓ ✓ View repository analytics ✓ ✓ ✓ ✓ ✓ View Value Streams Dashboard ✓ ✓ ✓ ✓ ✓ View GitLab Duo and SDLC trends ✓ ✓ ✓ ✓ ✓ Project application security Project permissions for application security features including dependency management, security analyzers, security policies, and vulnerability management. Action Guest Planner Reporter Security Manager Developer Maintainer Owner View dependency list ✓ ✓ ✓ ✓ View licenses in dependency list ✓ ✓ ✓ ✓ View security dashboard ✓ ✓ ✓ ✓ View vulnerability report ✓ ✓ ✓ ✓ Create vulnerability manually ✓ ✓ ✓ Create issue from vulnerability finding ✓ ✓ ✓ ✓ Create on-demand DAST scans ✓ ✓ ✓ ✓ Run on-demand DAST scans ✓ ✓ ✓ ✓ Create individual security policies ✓ ✓ ✓ Change individual security policies ✓ ✓ ✓ Delete individual security policies ✓ ✓ ✓ Create CVE ID request ✓ ✓ Change vulnerability status 1 ✓ ✓ ✓ Create security policy project ✓ Assign security policy project ✓ Configure SAST vulnerability resolution 2 ✓ ✓ ✓ Configure SAST false positive detection 2 ✓ ✓ ✓ Configure Secret detection false positive detection 2 ✓ ✓ ✓ Manage other security configurations 3 ✓ ✓ ✓ Footnotes : * The admin_vulnerability permission was removed from the Developer role in GitLab 17.0. * Security Managers can configure these settings in Settings > General > GitLab Duo . * Security Managers can only manage other security configurations through the UI ( Secure > Security configuration ). Project Secrets Manager Project permissions for GitLab Secrets Manager : Action Guest Planner Reporter Security Manager Developer Maintainer Owner View Secrets Manager user permissions ✓ ✓ Manage permissions for secrets ✓ Read secrets metadata 1 2 ✓ ✓ Create and update secrets 1 2 ✓ ✓ Delete secrets 1 ✓ Read secret value 3 Footnotes : * Users with the Owner role can grant this action to other roles, specific users, groups, or custom roles. See Manage secrets permissions . * Users with the Maintainer role have this permission by default for secrets managers enabled in GitLab 19.4 and later. Users with the Owner role can remove or change the default permissions for the Maintainer role. * No role can read a secret s value. CI/CD jobs read values through job authentication. Other workloads read values through the Secrets Manager API , and only if they have been granted the read value permission for that secret. Project CI/CD GitLab CI/CD permissions for some roles can be modified by these settings: * Project-based pipeline visibility : When set to public, gives access to certain CI/CD features to Guest project members. * Pipeline visibility : When set to Everyone with Access , gives access to certain CI/CD view features to non-proje