Restrict access to creating PROD deployment jobs

[Lars]

We have two types of environments : PROD and NONPROD. We have many, many applications.  (> 50)

The concept of environment type goes across applications in our organisation, i.e. each application (which equates to a Deployment Plan in Bamboo) will have at least two environments, e.g. for AppA there will be environments "AppA-PROD" and "AppA-NONPROD".

There are many people to whom we would like to grant access in Bamboo to create deployment jobs that end in a NONPROD-type environment. There are only a few who should be able to do the same for PROD-type environments.

How can this be accomplished?

I know that we can set permissions on an environment for a given plan once it has been setup, but that doesn't accomplish our goal of allowing people to set up their own deployments into NONPROD.

A few ideas

• We can possibly have Bamboo Agents that are permissioned to deploy into PROD and others that are not. Then we can have "Deploy-To-Prod" as a capability. However this only moves the problem: Is there a way to restrict access to capabilities in Bamboo?  (i.e. only certain users are allowed to create jobs which use a certain capability)
• We can - and will indeed - have two sets of Bamboo shared credentials, one for PROD and another for PREPROD. But this then begs the question how we restrict access to using those credentials in jobs ?
• ?

Please advice.

[Lars]

I'll answer my own question. 

It seems Agent Dedication  is the way to go. 

[Lars]

Ooops. That won't work.

An agent can be dedicated on two ways:

1. By the Bamboo global admin: From the Global Settings - by dedicating the agent (or the image if using the Elastic Bamboo feature) to one more more existing deployments environments.
2. By the person who creates/edit a deployment environment: This can have a dedicated agent. This will have the same effect as (1).

So if we have an agent with super-privileges then in fact any user (with permission to create/edit any type of deployment job) can do (2) and thereby circumvent (1). Therefore, Agent Dedication is not a way to restrict user's access to that agent.