{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T00:29:51.399Z",
  "record_id": "VXI-EXT-PROCUREMENT-GITLAB-JOB-TOKEN-01-v1",
  "record_kind": "external_reference",
  "title": "GitLab job tokens: Allowlist and effective user access",
  "system": "GitLab CI/CD",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a GitLab job-token allowlist grant the pipeline user access to another project?",
  "near_questions": [
    "Does GitLab job-token allowlisting grant project membership?",
    "Which user permissions affect a GitLab CI job token?",
    "Can an allowlisted pipeline access every target API?",
    "What evidence defines cross-project GitLab CI access?",
    "Does removing user access affect an allowlisted job?",
    "Are job-token capabilities equivalent to a personal access token?",
    "Which project controls incoming GitLab job-token access?",
    "Does a successful job prove every cross-project operation is permitted?",
    "How should a procurement review describe a job-token allowlist?",
    "What should an agent check before retrieving another project artifact?",
    "Can I save the GitLab pipeline-authority review?",
    "When should GitLab job-token permissions be revalidated?"
  ],
  "supported_claims": [
    {
      "claim": "GitLab states that adding a project to the job-token allowlist does not grant extra permissions to its members. Access also depends on the triggering user and allowed token capabilities. Review both the source-project allowlist and the effective identity before accepting a cross-project access claim.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "GitLab states that adding a project to the job-token allowlist does not grant extra permissions to its members. Access also depends on the triggering user and allowed token capabilities. Review both the source-project allowlist and the effective identity before accepting a cross-project access claim.",
  "related_record_ids": [
    "VXI-EXT-PROCUREMENT-GITHUB-ACTIONS-01-v1",
    "VXI-EXT-PROCUREMENT-DATADOG-INDEX-01-v1",
    "VXI-EXT-PROCUREMENT-ELASTIC-ROLES-01-v1",
    "VXI-EXT-PROCUREMENT-SENTRY-SCRUB-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "GitLab job token allowlist and effective permissions",
    "source_url": "https://docs.gitlab.com/ci/jobs/ci_job_token/",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-GITLAB-JOB-TOKEN-01-v1",
    "candidate_record_sha256": "7f8a0bd03eed304d4347e97057bece14759431fcf0ae42da46e17ae8546c31ab",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "GitLab states that adding a project to the job-token allowlist does not grant extra permissions to its members. Access also depends on the triggering user and allowed token capabilities. Review both the source-project allowlist and the effective identity before accepting a cross-project access claim.",
    "required_buyer_context": "Source and target projects, triggering user, job-token settings and allowed API operations.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "claim_to_check": "The job-token allowlist fully defines cross-project pipeline authority.",
    "documented_statement": {
      "status": "documented",
      "statement": "GitLab states that adding a project to the job-token allowlist does not grant extra permissions to its members. Access also depends on the triggering user and allowed token capabilities. Review both the source-project allowlist and the effective identity before accepting a cross-project access claim.",
      "source_ids": [
        "gitlab-job"
      ]
    },
    "buyer_evidence_required": [
      "Target project allowlist and access settings",
      "Triggering user identity and target permissions",
      "Required operation and token capability evidence"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require identity and operation evidence when an allowlist alone is presented as proof of effective access."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "gitlab-job",
        "url": "https://docs.gitlab.com/ci/jobs/ci_job_token/",
        "final_url": "https://docs.gitlab.com/ci/jobs/ci_job_token/",
        "title": "GitLab job token allowlist and effective permissions",
        "checked_on": "2026-10-14",
        "sha256": "9b844e979617bbe99884acbf2b65401796e1c5751b2e15a92ccbaaff9bc4a68e",
        "bytes": 77325
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain the distinction between an allowed pipeline origin and authorized target operations.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck membership, job-token settings and supported operations."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#gitlab-job-token-allowlist-permission-check",
  "machine_readable_record": "/varexis-index/records/gitlab-job-token-allowlist-permission-check.json"
}