Refine permissions for security features

Problem to solve

The number of issues related to permissions keeps increasing as we grow and implement more features. There is no clear convention or documentation today and some underlying complexity makes it error-prone when it comes to add or update permissions or new features.

Intended users

devopssecure team members

Proposal

• Engineering: Write down the list of features provided by devopssecure and the corresponding permissions (from the code).
• UX/Product: Analyse, flag inconsistencies and define the new expectations
• Engineering: Define permission conventions to apply when adding/updating a feature
• Engineering: Update the permissions based on the new expectations
  • Create new missing policies
  • Update existing policies
  • Update docs

Documentation

• make sure public documentation about permission is up to date: https://docs.gitlab.com/ee/user/permissions.html
• create developer-oriented documentation about which permissions we use and how to add new ones

What does success look like, and how can we measure that?

• clean description of our permissions and how to add/update them.
• fewer issues regarding permissions bug or inconsistencies

New permissions summary

Status	Activity level	Resource	Locations	Licensed feature	Policy	Note
	View	License information	Dependency list, License Compliance	License Compliance	Can view repo
	View	Dependency information	Dependency list, License Compliance	Dependency Scanning	Can view repo
	View	Vulnerabilities information	Dependency list	Dependency Scanning	Can view security findings
	View	Black/Whitelisted licenses for the project	License compliance, Merge request	License Compliance	Can view repo	Inconsistency now it's can read project
	View	Security findings	MR, CI job page, Pipeline security tab	One of the Secure features	Can read the project and CI jobs	Doesn't exist now
	View	Vulnerability feedback	MR	One of the Secure features	Can read security findings
	View	Security dashboard	Project, Group	One of the Secure features	Is Developer+
	View	Dependency List page	Project	Dependency List	Can access Dependency information
	View	License Compliance page	Project	Licenses List	Can access License information
	Use	Vulnerability feedback (create an issue, dismiss, fix w/suggestion)	Security Dashboard, MR, Pipeline security tab	One of the Security features	Is Developer+
	Manage	Licenses and license policy (approve/blacklist/manually add new)	Merge Request, License Compliance	License Compliance	Is Maintainer+
	Manage	Vulnerability MR policy (security-gates)(vuln-check)	Merge Request, Settings	One of the Secure features	Is Maintainer+