Access control for Batch Changes

Granular controls for who can access Batch Changes can be configured by administrators by tuning the roles assigned to users and the permissions granted to those roles. This page describes the permission types available for Batch Changes, and whether they are granted by default to the User system role. All permissions are granted to the Administrator system role by default.

Name	Description	Granted to User by default?
`batch_changes:read`	User can view batch changes, changesets, and batch specs. User can view bulk operations and batch spec workspaces.	✓
`batch_changes:write`	User can create, update, close, or delete batch changes. User can create, execute, and apply batch specs. User can perform bulk operations on changesets such as publishing, commenting on, closing, or merging them.	✓
`batch_changes:agent_read`	User can view agentic batch changes, including agents, their conversations, and results. Requires `batch_changes:read` as well.	✓
`batch_changes:agent_write`	User can create, run, and modify agentic batch changes. Requires `batch_changes:write` as well.	✓

These permissions gate access to the Batch Changes feature as a whole. Within a batch change, what a user can see and do is further limited by the batch change's permission levels and by their repository permissions. Merging changesets can additionally be restricted to administrators with the batchChanges.restrictMergeToAdmins advanced configuration property.

The advanced configuration property batchChanges.restrictToAdmins is deprecated and has no effect. To restrict Batch Changes to administrators, remove the batch_changes:read and batch_changes:write permissions from the User role instead.

Access control for Batch Changes

Name	Description	Granted to User by default?
`batch_changes:read`	User can view batch changes, changesets, and batch specs. User can view bulk operations and batch spec workspaces.	✓
`batch_changes:write`	User can create, update, close, or delete batch changes. User can create, execute, and apply batch specs. User can perform bulk operations on changesets such as publishing, commenting on, closing, or merging them.	✓
`batch_changes:agent_read`	User can view agentic batch changes, including agents, their conversations, and results. Requires `batch_changes:read` as well.	✓
`batch_changes:agent_write`	User can create, run, and modify agentic batch changes. Requires `batch_changes:write` as well.	✓