## Problem Users don't have visibility into how their project is being accessed via CI_JOB_TOKEN. Hence, they struggle to enable the job token scope via project setting as it may break pipelines if some source projects are not allowlisted. - **Target milestone:** %"17.5" ## Expected outcomes - Users are able to see what projects not currently in the (disabled) allowlist are accessing the current project using CI_JOB_TOKEN. - Users can use this information to add those projects to the allowlist. Once added to the allowlist, authentications from this project are no longer appearing to the authentications log. - Users can dismiss authentication log entries for a given project and those won't appear in the list again. - Users should be able to enable the job token scope allowlist successfully without breaking changes for their expected use cases. This will start blocking authentications from projects not allowlisted. - When job token scope is enabled, the authentications log is no longer updated and can be hidden from the UI. ## Communication - This phase can be announced in a standard release post as it's an additive change. - For Gitlab.com users we can issue a blog post defining the plan ahead of time (e.g. talk about phase 2 and 3). - In-app notifications for project owners to encourage them to review their authentication logs, refine the allowlist and finally enable it.