Access Control

CodeCargo provides role-based access control at the organization and project levels, with team management for grouping users and personal access tokens (PATs) for API authentication.

Organization Access

Manage your organization's users and teams from Organization Settings → Access. The access page has three tabs: People, Teams, and Support.

People

The People tab lists all users in your CodeCargo organization. Each user has an organization-level role:

Organization Admins can update user roles from the actions menu on each row.

Teams

Teams let you group organization members for easier project access management. Instead of granting access user by user, assign a team to a project and all team members receive the same role.

Click a team name to view its detail page, which lists all current members with their GitHub avatars and names.

Project Access

Each project has its own Access page where you control who can view and manage project resources. Navigate to a project and click Access in the sidebar.

Project Roles

Granting Access

Click Grant to add a user or team to the project. Select whether you are adding a user or a team, choose the member, assign a role, and click Submit.

Access Sources

Project access can come from multiple sources. The access list shows the origin of each entry:

Only Explicit access entries can be updated or removed. Non-explicit entries can be "upgraded" — granting explicit access replaces the implicit entry. Someone who only has repository access is a Viewer, so grant them an explicit role if they need to manage the project.

Organization Admins automatically have access to all projects and cannot be downgraded.

Team Org-Level Roles

Teams with organization-level Admin or Architect roles automatically receive Admin access to all projects in the organization. This inherited access appears in the project access list as access granted through the team rather than as an individual entry.

Key behaviors:

• Teams with Admin or Architect org roles get automatic Admin project access
• This inherited access cannot be downgraded to Editor or Viewer roles
• Team members appear in project access through their team, not as individual entries
• Explicit team access can only maintain or upgrade the inherited role level

Migration Assistant Access

Migration Assistant operations require the MigrationAssistantManage permission, which is granted to teams with organization-level Admin or Architect roles. This allows migration work to be performed without requiring GitHub organization owner privileges.

Permission Scope:

• Create, update, and delete migration entities and batches
• Configure migration mappings and repository associations
• Import legacy CI/CD data and manage migration workflows
• Launch migrations via "Migrate in Editor" to open the GenAI Editor for AI-assisted conversion

Role Access:

• Org-level Admin and Architect roles: Full Migration Assistant management capabilities
• Member (org role): Read-only access to view migration data and progress

This permission model enables platform architects and migration specialists to manage large-scale CI/CD migrations without requiring the elevated privileges typically associated with organization administration.

Repository Migrations:

Copying repositories to GitHub through Migrating Repositories is gated separately, because a migration spends your personal access tokens and creates repositories in your GitHub organization:

• MigrationAssistantMigrateRepositories - Create, start, stop, retry, skip, and abandon repository migrations, revoke a migration's token, and edit the custom property mapping. Granted to the org-level Admin role only.
• Connecting or disconnecting a source system (for example, signing in with Microsoft to connect Azure DevOps) requires organization administration.
• Viewing connections, the repository inventory, and migration history needs only MigrationAssistantManage.

Personal Access Tokens

Personal Access Tokens (PATs) allow you to authenticate with the CodeCargo API programmatically. Manage your tokens from Profile → Personal Access Tokens.

Token Status

Managing Tokens

From the actions menu on each token you can:

• Edit — update the expiration date
• Delete — permanently revoke the token (requires confirmation)

The token list shows each token's short ID, status, last used timestamp, and expiration date.

Creating a Token

1. Click Create
2. Choose an expiration: 7 days, 30 days (the default), 60 days, 90 days, 1 year, a Custom date, or No expiration
3. Click Submit
4. Copy the token immediately — it will not be shown again

GitHub Permissions Integration

CodeCargo's access model integrates with GitHub in several ways:

• Repository Access: Users who have access to a GitHub repository linked to a project automatically gain project access (shown as "Repo Access" source)
• Organization Owners: GitHub organization owners receive automatic full access to all CodeCargo projects
• Team Sync: CodeCargo team membership is synced from your GitHub organization's team structure
• Explicit Overrides: You can always grant explicit CodeCargo access that supplements or overrides GitHub-based permissions

Support Access

Organization administrators can enable support access to allow CodeCargo support team members to access your organization for troubleshooting and assistance. This feature is disabled by default and requires explicit opt-in.

To enable support access:

1. Navigate to Organization Settings → Access and open the Support tab
2. Turn on Support access

When support access is enabled:

• CodeCargo support team members can be granted temporary access to your organization
• Support users can view organization resources but cannot make changes without explicit permission
• Support access is managed through administrative commands and requires organization opt-in
• Organizations that haven't enabled support access remain completely inaccessible to support users

Repository Access Validation

CodeCargo continuously validates your access to repositories during operations like changeset management. If your permissions to a repository are removed while you're working with it (for example, if you're removed from a team that had access), you'll see a security-conscious error message:

"Repository is not available"

This message protects against information disclosure while letting you know that the repository can no longer be accessed. Repository access is re-validated each time you perform operations to ensure you only work with repositories you currently have permission to access.