Review access change

Change-Id: I9d0384631958293cbea17326d95b371c990d713b
diff --git a/groups b/groups
index 3784fbf..f6f6c5a 100644
--- a/groups
+++ b/groups
@@ -1,6 +1,12 @@
-# UUID                 	Group Name
+# UUID                                  	Group Name
 #
-global:Anonymous-Users 	Anonymous Users
-global:Project-Owners  	Project Owners
-global:Registered-Users	Registered Users
-mdb:coral-eng          	mdb/coral-eng
+050a20aa2f20dfaad8ef58e9c8d7f35d19eec491	Allowed-Developers
+22c1e76f8b71798968d11dd21d7cb0844aba386a	FTE-Googlers-Read-Only
+2f6f1b1ba8b940f686a1c890e4a36548c898ddfd	Google-Developer
+6db05635a9566b3933fe50a7169fe688183a1e28	Coral-Admins
+global:Anonymous-Users                  	Anonymous Users
+global:Project-Owners                   	Project Owners
+global:Registered-Users                 	Registered Users
+mdb:coral-eng                           	mdb/coral-eng
+mdb:kokoro                              	mdb/kokoro
+mdb:kokoro-dedicated                    	mdb/kokoro-dedicated
diff --git a/project.config b/project.config
index 1f70373..1cbdcb3 100644
--- a/project.config
+++ b/project.config
@@ -10,43 +10,43 @@
 [capability]
 	administrateServer = group mdb/coral-eng
 [access "refs/*"]
-	read = group Anonymous Users
-	read = group mdb/coral-eng
+	read = group Allowed-Developers
+	read = group FTE-Googlers-Read-Only
+	read = group Google-Developer
+	read = block group Anonymous Users
+	read = block group Registered Users
 [access "refs/for/refs/*"]
-	push = group Registered Users
-	pushMerge = group Registered Users
+	push = group Allowed-Developers
+	push = group Google-Developer
+	push = block group Registered Users
+	pushMerge = group Allowed-Developers
+	pushMerge = group Google-Developer
+	pushMerge = block group Registered Users
 [access "refs/heads/*"]
-	create = group Project Owners
-	create = group mdb/coral-eng
-	forgeAuthor = group Registered Users
-	forgeCommitter = group Project Owners
-	forgeCommitter = group mdb/coral-eng
-	push = group Project Owners
-	push = group mdb/coral-eng
+	create = group Coral-Admins
+	create = group Google-Developer
+	forgeAuthor = deny group Allowed-Developers
+	forgeAuthor = deny group Google-Developer
+	forgeAuthor = group Coral-Admins
+	forgeAuthor = block group Registered Users
+	forgeCommitter = deny group Google-Developer
+	forgeCommitter = group Coral-Admins
+	push = deny group Google-Developer
+	push = group Coral-Admins
+	label-Code-Review = -2..+2 group Google-Developer
 	label-Code-Review = -2..+2 group Project Owners
+	label-Code-Review = -2..+2 group Project Owners
+	label-Code-Review = -2..+2 group Registered Users
 	label-Code-Review = -2..+2 group mdb/coral-eng
+	label-Code-Review = -2..+2 group mdb/coral-eng
+	label-Code-Review = -1..+1 group Allowed-Developers
 	label-Code-Review = -1..+1 group Registered Users
-	submit = group Project Owners
-	submit = group mdb/coral-eng
-	editTopicName = +force group Project Owners
-	editTopicName = +force group mdb/coral-eng
+	pushMerge = deny group Google-Developer
+	pushMerge = group Coral-Admins
 [access "refs/meta/config"]
-	exclusiveGroupPermissions = read
-	read = group Project Owners
-	read = group mdb/coral-eng
-	push = group Project Owners
-	push = group mdb/coral-eng
-	label-Code-Review = -2..+2 group Project Owners
-	label-Code-Review = -2..+2 group mdb/coral-eng
-	submit = group Project Owners
-	submit = group mdb/coral-eng
-	create = group Project Owners
-	create = group mdb/coral-eng
 [access "refs/tags/*"]
-	createTag = group Project Owners
-	createTag = group mdb/coral-eng
-	createSignedTag = group Project Owners
-	createSignedTag = group mdb/coral-eng
+	createSignedTag = group Google-Developer
+	push = group Google-Developer
 [label "Code-Review"]
 	function = MaxWithBlock
 	defaultValue = 0
@@ -54,8 +54,13 @@
 	copyAllScoresOnTrivialRebase = true
 	value = -2 This shall not be merged
 	value = -1 I would prefer this is not merged as is
-	value =  0 No score
+	value = 0 No score
 	value = +1 Looks good to me, but someone else must approve
 	value = +2 Looks good to me, approved
 [access "refs/for/*"]
-	addPatchSet = group Registered Users
+	addPatchSet = group Allowed-Developers
+	addPatchSet = group Google-Developer
+	addPatchSet = group mdb/kokoro
+	addPatchSet = group mdb/kokoro-dedicated
+	addPatchSet = block group Anonymous Users
+	addPatchSet = block group Registered Users