Feature overview
Important to note: If you're looking to assign permissions for Salesforce orgs that are not used in team-shared CI jobs, then these permissions are configured differently.
Read the documentation on sharing org credentials with team members for guidelines on how to assign permissions for:
CI jobs that are not converted to team-shared CI jobsOrg connections that are not used in team-shared CI jobs
Note: Team owners will always have "Admin" permission on all team-shared resources (e.g. org connections, CI jobs and Pipelines), which bestows the same level of access as the "Edit" permission, with the addition of being able to delete team-owned resources and update their permissions.
Controlling which members can run and edit team-shared CI jobs or team-shared Pipelines is an important part of any secure large team.
A Pipeline is a connected flow of environments (e.g. Dev → Integration → UAT → Prod) that helps teams move changes safely through each stage. Pipelines control the overall release flow, but each static environment in the Pipeline maps to a CI job. Users need the correct CI job permissions (especially Run) to be able to promote changes into the environments included in that Pipeline.
Pipeline permissions determine whether a user can see and edit the pipeline configuration (the pipeline resource).
CI job permissions determine whether a user can actually run deployments / promote changes into specific environments in that pipeline (since promotion is controlled at the CI job level).
So users typically need Pipeline access + the right CI job access depending on whether they’re just viewing the pipeline, or actively promoting changes through it.