Permissions

Grant access per repository, with service administration kept separate.

Repository roles

A repository has three roles:

• Reader: clone/fetch and read permitted repository metadata; file browsing when the essentials update is installed.
• Writer: reader access plus Git pushes to active repositories.
• Repository admin: writer access plus management of that repository's settings, memberships, lifecycle and exports.

Without a grant, access is denied. An account must also be enabled and free of an applicable emergency deny. Archived repositories remain readable but reject writes; deleted repositories reject Git access even if a membership remains.

Manage membership

Open a repository's membership controls as a current repository admin or service admin. Select existing enabled users and their roles, then save. Membership updates are versioned: a stale form is rejected so it cannot overwrite a newer policy change. Reload, review the current memberships and submit the intended change again.

The service checks current permissions in the mutation transaction. Hiding a button is never the authorization boundary. Removing a membership blocks subsequent authorized requests; data already delivered cannot be recalled.

Service administrators

Service admins manage the service, accounts, repository creation/import, storage policy and global audit. Only they may permanently purge a repository. A repository admin cannot promote themselves to service admin, manage other people's keys or use the private operator API.

Regular users see permitted repositories and their own keys. Repository admins receive controls for their repositories; service admins receive global controls. The console and CP Hub act on the same underlying policy records when both are used.

Emergency denies and key revocation

An operator can apply an audited emergency deny to a user, key or repository. It overrides grants until explicitly cleared. Key revocation permanently reserves the key fingerprint. Neither changing a display name nor restoring a repository reinstates old permissions.

See security for process boundaries and CLI and API for local operator access.