Please add these scopes to moz-tree:level:1 : project:releng:balrog:channel:* project:releng:balrog:server:dep project:releng:beetmover:action:* project:releng:beetmover:bucket:dep project:releng:googleplay:dep We're essentially following signing, where all the format scopes are allowed, but we restrict by key type (release / nightly / dep). So the balrog channels and beetmover actions will all be allowed, but only against staging servers + buckets. Right now the googleplay:dep scope will throw an exception, but we can add a dry-run with that scope.

Could we also add project:releng:buildbot-bridge:* queue:route:index.releases.v1.maple.* to maple?

Scopes in the description have been added to moz-tree:level:1 https://tools.taskcluster.net/auth/roles/moz-tree%3Alevel%3A1

For now, I have manually updated maple to have those two scopes. In the future, we'll find a way of defining project level scopes that tc-admin can use when creating the role. Please reopen if there is an issue.

Thanks!