Enterprise administrators needed a way to grant specific admin area access without handing over full system control. I designed a new permission layer that replaced GitLab's all-or-nothing admin model — reducing 250 overprivileged admins to the industry standard of 1–2.
GitLab's admin model was binary: full administrator access or none. For enterprise teams, support staff who needed read access to the admin area had to be granted full admin privileges — creating serious compliance and security exposure.
This was one of GitLab's top 5 security risks, and a blocker for enterprise customers in regulated industries.
Before designing, I explored two fundamentally different models for how custom admin roles would relate to existing user types.
| Consideration | OR — New user type alongside Regular/Auditor | AND — Permission layer on top of existing types |
|---|---|---|
| Mental model | Replaces familiar access level concept | Builds on what admins already understand |
| Scalability | Dropdown grows with every new role | Admin roles stay separate from member roles |
| Scope | Groups group/project access with admin permissions | Admin area permissions stay cleanly separated |
| LDAP risk | Risk of breaking existing integrations | Additive — no disruption to existing setup |
Users already understood Regular vs. Auditor. Adding custom admin permissions on top preserved that — and avoided a disruptive mental model shift.
Decision: AND operation — keep existing user types, add custom admin role as a separate permission layer. Validated with customers before any further design investment.
Create custom admin role. A new "Admin role" option in Roles & Permissions, separate from member roles. Admins select specific admin area permissions with descriptions to support deliberate access decisions.
Assign to a user. Regular and Auditor users can be assigned a custom admin role as a separate layer — "No access" by default, with a dropdown to assign any created role.
Roles & Permissions table. Clear visual distinction between admin and member roles via badges. Edit and delete follow the same patterns as member roles for consistency.
Safe deletion. A custom admin role can only be deleted after being unassigned from all users — preventing accidental access removal at scale.
User list filtering. Filter by custom admin role, with a truncated badge (max 150px, full name on hover) for long role names.