Group Direction - Authorization

1. You are here:
2. GitLab Direction
3. Product Stage Direction - Software Supply Chain Security
4. Group Direction - Authorization

• Overview
• Top themes
• Priorities
• Jobs to be Done

Group	Authorization
Stage	Govern
Group	Authorization
Content Last Reviewed	2024-12-17

Overview

This is the direction page for the Authorization group in the Software Supply Chain Security stage. The Authorization group is responsible for ensuring that an authenticated user has access to the proper resources within the application. Additionally, the group builds capabilities to detect and prevent malicious activity from occurring within GitLab environments.

1. Permissions
2. Instance Resiliency

Top themes

Priority	Theme	Target Release
1	Add support for granular token permissions to Job Tokens to allow for fine-grained access in CI/CD workflows.	18.0
2	Build Admin Custom Role to support granular permissions for the Admin Area to allow organizations to reduce the number of admins on self-managed environments.	17.10
3	Improve visibility by providing a breakdown of roles and assigned users to allow for organizations to identify and reduce overprivileged users.	Deprioritized

Priorities

Priority	Name	DRI	Target Release
1	Show fine-grained permissions in job token permissions section	hmehra	17.8
2	Add ability to create/update a project with fine-grained job token permissions	dftian	17.8
3	Toggle between default and fine-grained (backend)	dftian	17.8
4	Implement granular read_admin_subscription permission	TBD	17.8
5	Implement read_admin_users permission	TBD	17.8
6	Implement granular read_admin_monitoring permission	TBD	17.8
7	Assign custom role when sharing a group to a 'project'	eugielimpin	17.8
8	Confidential	hmehra	17.8
9	Pre-selected permissions based on base default role	imand3r	17.8
10	Custom Admin Role - Security testing	TBD	17.9

Jobs to be Done

The UX department has performed a JTBD Canvas for Authorization that can be found on this epic and figma file.

The main jobs for users related to Authorization capabilities include:

Main Job	Outcomes
Provision access rights	Minimize productivity loss coming from user’s lack of access to resources they need to do their job. Minimize security risk and data breaches coming from bad actors. Reduce manual work when managing user’s role and access to resources.
Maintain access policies	Minimize security risk and data breaches coming from bad actors. Increase compliance in industry related audits (eg SOC II). Standardize organization’s user and resource permission management across all software and applications.
Gain access rights	Decrease time spent on gaining access rights. Increase productivity Increase team collaboration.