so, we have a repositories set up like:
where repoB and repoC are "branch repositories" of repoA.
we use repoA as "the trunk" and all of our CI process is tied to it. so the workflow is whenever we nee to work on a new feature or bug, we create a new branch repository (repoB, C, etc) and work on it. there is a review process that is done before that is pushed into repoA.
the problem is, that sometimes a developer will accidentally push into repoA. we really have to prevent this.
but if we give "read only" access to repoA, then the developer cannot create branch repositories. only by giving "modify" access to repoA can we allow developers to create repoB, etc.
this seems like a severe problem. as our team grows it is becoming more and more of a problem. I cannot create all the branches for everyone. nor can I allow them to continue "making mistakes" and pushing right into "the trunk" (repoA).