How do I manage permissions for repositories?

The control panel gives you fine-grained control over who can access your repositories and what they can do. You can grant access to individual users or to teams (groups of users), each with their own permission level and optional path restriction.

Every user or team on a repository has a permission level:

• Deny – No access to the repository (or to the specified path). Useful for explicitly blocking access.
• Read – Can check out and browse the repository, but cannot commit changes.
• Write – Full access: can both read and commit changes.

1. Go to Repositories and click on the repository
2. Under the Users section, search for a user and click Add user
3. Set their permission level using the dropdown
4. Click Save

Teams let you group users so you can manage access for multiple people at once.

1. First, create a team under Teams in the main navigation and add users to it
2. On the repository page, under the Teams section, search for the team and add it
3. Set the team’s permission level using the dropdown
4. Click Save

All members of the team inherit the team’s permission on the repository. If a user is granted access both individually and through a team, the standard Subversion authz rules apply: the most specific match wins.

On Enterprise plans, you can restrict permissions to specific paths within a repository. This lets you give different access levels to different parts of your codebase.

By default, every permission entry applies to All paths (the entire repository). To restrict access to a specific path, edit the path field next to the permission dropdown.

You can add the same user or team multiple times with different paths and permission levels. For example:

• michael – Write on /trunk/src
• michael – Deny on All paths (everything else)

This means michael can commit changes inside /trunk/src but is denied access to the rest of the repository.

Permission resolution follows the same semantics as the standard Subversion authz file:

• The most specific path match takes precedence. A rule on /trunk/src overrides a rule on /.
• If multiple rules match the same path at the same specificity, explicit Deny takes priority.
• User-level permissions override team-level permissions for the same path.
• If no rule matches a path, access is denied by default.

This means you can set up broad team access and then fine-tune individual paths as needed.