## Context GA does not ship without a role management UI, which the public GA epic https://gitlab.com/groups/gitlab-org/-/epics/22707 lists at P0 as https://gitlab.com/gitlab-org/gitlab/-/work_items/605679. Role assignment is API-only in closed beta. The repository-level role management screen is the **Manage access** side panel that https://gitlab.com/gitlab-org/gitlab/-/work_items/606444 tracks. [`monolith/S09`](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/monolith/S09-repository-access-management.md) specifies that panel. https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3060 merged the spec on 2026-10-01. The spec shows the Manage access item only when the repository's `delete_repository` verdict allows it. Its Gate resolution calls that gate provisional until the ADR-021 owner decides here. The gate is presentation only, because IAM authorizes every lookup, grant, and revoke. A wrong verdict mis-renders the item and grants nothing. ## What exists on main Each line holds at `d7fcf10e6`. The ADR-021 mirror matched the handbook on 2026-10-01. - `docs/adr/021_authorization.md`, `### Default permission buckets`: `delete_repository` belongs to Artifact Admin alone. Line 127 keeps managing role assignments out of the permission set: "Only Artifact Admin holds it." - `docs/adr/021_authorization.md`, `### Role assignment`: only Artifact Admin manages assignments, at the namespace and the repository level. At the repository level, Artifact Admin adds `delete_repository` and managing assignments over Artifact Manager (line 194). The same line gives `create_repository` no repository-level meaning. - `docs/adr/021_authorization.md`, `### Permission checks for UI gating`: verdicts name actions, and the permission-to-action mapping belongs to the registry (line 256). A surface's resource-level bindings fix its action set, and the OpenAPI contract publishes it (line 262). Verdicts are advisory (line 287). - `docs/adr/021_authorization.md`, `### Custom roles`: deferred. A custom role can hold any combination of the permissions (line 338). - `docs/specs/S09-authorization.md`, `### Permission verdicts` (lines 410-419): the repository surface carries nine actions and the namespace surface seven, each the set ADR-021 binds at that level. `api/openapi/v1.yaml` publishes them as the closed schemas `RepositoryPermissions` (lines 3610-3646) and `NamespacePermissions` (lines 3578-3608). Neither has an access-management verdict. - `internal/authz/verdicts.go`, `RepositoryVerdictActions` (line 49): returns the nine repository actions. `VerdictEvaluator.Evaluate` answers them through one relationships read and one GLAZ `BatchCheck`. - `internal/managementapi/detail.go`, `detailVerdicts` (line 88): the repository detail read with `include_permissions=true` evaluates that set for the repository and its ancestors. `monolith/S09` gates Manage access on this read's `delete_repository` verdict. - `internal/authz/glaz/checker.go` (line 17) and `internal/managementapi/list_authz.go` (line 408): the service sends GLAZ an ADR-021 permission name. The role ids live in the GLAZ catalog, and GLAZ resolves roles to permissions (ADR-021 `### Authorization flow`). No file in this repository maps a role to a permission. - `docs/specs/monolith/S09-repository-access-management.md`, `### Entry point` (lines 172-176) and criterion 9 (line 319): Manage access renders when both flags are on and `userPermissions.deleteRepository` is true. - `docs/specs/monolith/S09-repository-access-management.md`, `## Resolutions` Gate (lines 426-440): the gate is provisional pending this issue. Its fixed-role constraint requires the gate to move to an access-management verdict, through an ADR-021 amendment, once a custom role can hold `delete_repository` without managing access or the reverse. `## Follow-ups` (lines 409-411) lists this issue. - `docs/specs/monolith/S15-permission-gated-controls.md`, `### Every ADR-021 permission, and its treatment here` (line 237) and `### Surfaces gated on arrival` (line 421): both list Manage access under `delete_repository`. Rules 2 and 3 (lines 174 and 179) have Rails transcribe the contract's closed sets and never derive a verdict. Line 229 requires a row in the permission table for any permission added to ADR-021. ## Change The ADR-021 owner decides whether ADR-021 changes now or with custom roles, when the `monolith/S09` fixed-role constraint requires the change. Under option 1, `delete_repository` stays the Manage access gate until then. Only `monolith/S09` changes now. Under option 2, a handbook MR amends ADR-021 now. The contract, the service, and the monolith specs follow it. ## Acceptance criteria 1. ADR-021 and `docs/specs/S09-authorization.md` define no verdict for managing access, so the ADR-021 owner (`10io`) decides this criterion and records the decision on this issue: - **Option 1, accepted.** `delete_repository` is an accepted UI gate for managing repository access while the four built-in roles are fixed. The gate moves to an access-management verdict when custom roles land. - **Option 2, deviation.** The gate deviates from ADR-021, and a handbook MR amends ADR-021, for example with an access-management verdict. 1. Under option 1, an MR changes only `docs/specs/monolith/S09-repository-access-management.md`. In that file, the `## Resolutions` Gate no longer calls the gate provisional and keeps the fixed-role constraint. The file's `## Follow-ups` no longer lists this confirmation. 1. Under option 2, this issue links the handbook MR that amends the [ADR-021 source](https://gitlab.com/gitlab-com/content-sites/handbook/-/blob/main/content/handbook/engineering/architecture/design-documents/artifact_registry/decisions/021_authorization.md). `docs/adr/021_authorization.md` changes only through the daily `sync:adrs` CI job. 1. Under option 2, this issue links follow-up issues for the Go-service S09 action sets, `api/openapi/v1.yaml` `RepositoryPermissions`, `internal/authz/verdicts.go`, the two `monolith/S15` rows (lines 237 and 421), the `monolith/S09` gate, and the GLAZ catalog if GLAZ evaluates the verdict. Once they land, the repository detail read with `include_permissions=true` answers the access-management verdict `true` for an Artifact Admin at either level and `false` for the other three roles. Manage access then renders on that verdict. ## Specs and ADRs - [ADR-021 handbook source](https://gitlab.com/gitlab-com/content-sites/handbook/-/blob/main/content/handbook/engineering/architecture/design-documents/artifact_registry/decisions/021_authorization.md): where an amendment goes. - ADR-021 [Default permission buckets](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/adr/021_authorization.md#default-permission-buckets), [Role assignment](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/adr/021_authorization.md#role-assignment), [Permission checks for UI gating](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/adr/021_authorization.md#permission-checks-for-ui-gating), and [Custom roles](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/adr/021_authorization.md#custom-roles): the sections the decision rests on. - [S09 Permission verdicts](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/S09-authorization.md#permission-verdicts): the action set of each surface. - [monolith/S09 Entry point](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/monolith/S09-repository-access-management.md#entry-point) and [Resolutions](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/monolith/S09-repository-access-management.md#resolutions): the gate and its fixed-role constraint. - [monolith/S15 Every ADR-021 permission, and its treatment here](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/specs/monolith/S15-permission-gated-controls.md#every-adr-021-permission-and-its-treatment-here): the `delete_repository` consumers. ## Dependencies - https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3060 merged on 2026-10-01, so the decision waits on nothing. - https://gitlab.com/gitlab-org/gitlab/-/work_items/606444 tracks the Manage access UI. Under option 2, its gate moves only after `api/openapi/v1.yaml` and `monolith/S15` carry the access-management verdict, because `monolith/S15` has Rails take every action from the contract and derive none. If GLAZ evaluates the verdict, the GLAZ catalog change lands before the service answers it. - https://gitlab.com/gitlab-org/gitlab/-/work_items/590721 tracks custom roles. Under option 1, the gate moves before custom roles ship, as the `monolith/S09` fixed-role constraint requires. ## First step The ADR-021 owner records the decision on this issue. Under option 1, the first MR is the `monolith/S09` spec change in criterion 2. Under option 2, it is the handbook MR amending ADR-021, ahead of the linked issues. ## Original description ## Why The repository Manage access side panel (`monolith/S09`, `docs/specs/monolith/S09-repository-access-management.md`, from https://gitlab.com/gitlab-org/ops/artifact-registry/-/merge_requests/3060) shows its kebab item only when the repository's `delete_repository` verdict allows it. The verdict is a presentation-only proxy: IAM authorizes every lookup, grant, and revoke, so a wrong verdict mis-renders the item but grants nothing. ADR-021 has no verdict for managing access: - `### Permission checks for UI gating` gives the registry the permission-to-action mapping. - `### Default permission buckets` says: "Managing role assignments does not appear in the table above, because it is not an Artifact Registry permission (see Role assignment). Only Artifact Admin holds it." Among the four built-in roles, `delete_repository` and managing access belong to the same role, Artifact Admin, at both the namespace and the repository level (`### Default permission buckets`, `### Role assignment`). `create_repository` is also Admin-only, but it is not in the repository verdict set, and ADR-021 gives it no repository-level meaning, so it would hide the item from a repository-level Admin. The proxy holds only while the built-in roles are fixed. A custom role (`### Custom roles`, deferred) could grant one without the other. ## Decision needed @10io, as the ADR-021 owner, please confirm one of: 1. **Accepted.** `delete_repository` is an accepted UI gate for managing repository access while the roles are fixed. The spec's Gate resolution already records the fixed-role constraint, and the gate moves to a dedicated verdict when custom roles land. 2. **Deviation.** It deviates from ADR-021 and needs an amendment, for example a verdict that names access management. That would mean a handbook ADR-021 MR, a change to the Go-service S09 verdict set and `api/openapi/v1.yaml`, and an update to the `monolith/S09` gate. ## Done when - The decision is recorded on this issue. - For option 1, the `monolith/S09` Gate resolution no longer calls the gate provisional. - For option 2, the ADR amendment MR and its follow-up issues are linked here. Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/606444