Roles & permissions¶
Qaack separates who can manage the group from who can manage a single repository.
Layers¶
- Group role (Owner / Admin / Member) — group settings, creating or deleting repositories, group variables.
- Repository maintainer — optional per-repo access for a group Member to edit that repository’s settings without becoming a group admin. Configure under Security & access.
Every group member has one group role. The user who creates a group is its Owner.
- Owners can promote or demote any member, including other admins. Only an owner can change another owner’s role.
- Admins can promote members to admin and demote other admins, but cannot change an owner’s role.
- Members can view the group, its repositories, and environments. They cannot change group settings. To edit a specific repository’s settings they need to be a repository maintainer of that repo (or be promoted to Admin/Owner).
Permission matrix¶
Maintainer is not a group role. The column means a group Member who was granted maintainer on that repository. Group owners and admins already manage every repository and do not need a maintainer row.
| Action | Owner | Admin | Maintainer (that repo) | Member |
|---|---|---|---|---|
| View group, repos, and environments | ✓ | ✓ | ✓ | ✓ |
| Rename or delete the group | ✓ | ✓ | — | — |
| Add / remove members; change roles | ✓ | ✓¹ | — | — |
| Create / edit / delete group variables | ✓ | ✓ | — | — |
| Create / delete / transfer a repository | ✓ | ✓² | — | — |
| Edit repository settings³ | ✓ | ✓ | ✓ | — |
| Add / remove maintainers | ✓ | ✓ | ✓ | — |
| Delete a reusable environment | ✓ | ✓ | ✓ | — |
| Sync git refs; spawn, build, rebuild, or delete environments | ✓ | ✓ | ✓ | ✓ |
| Service logs, console, and exec | ✓ | ✓ | ✓ | ✓ |
¹ Admins cannot change an owner’s role. Only an owner can change another owner’s role.
² Transfer also requires Owner/Admin of the destination group.
³ Name, TTL, qaackfile, webhooks, IP allowlist, private registries, repository variables, GitLab token, and similar repository settings. Members can open repository settings read-only.
Need someone to own one repo only?
Keep them as a group Member, then grant maintainer on that repository under Repository settings → Security & Access. Full walkthrough: Repository maintainers.