# Permissions on retry

**URL:** https://forum.buildkite.community/t/permissions-on-retry/1530
**Category:** Features Requests
**Created:** [April 16, 2021, 11:43pm UTC](https://forum.buildkite.community/t/permissions-on-retry/1530 "2021-04-16T23:43:45Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ianbrex](https://avatars.discourse-cdn.com/v4/letter/i/8c91f0/32.png) [@ianbrex](https://forum.buildkite.community/u/ianbrex)
#### Post date: [April 16, 2021, 11:43pm UTC](https://forum.buildkite.community/t/permissions-on-retry/1530/1 "2021-04-16T23:43:45Z")

</div>

Hi,

Currently any user in our organization can retry failed jobs on Deployment pipeline.  
This can lead to an older job to run with older deployment artifacts, while the newer build was already deployed.  
Would it be possible to add limitation keyword on retry, so than we can limit retry to the Admin group only? (we actually might need retries on Deployment pipelines jobs if we’re in incident and re-running whole CICD would be time consuming)

Thanks,  
Ian

---

<div class="post-metadata">

### Author: ![juanitofatas](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/juanitofatas/32/957_2.png) [@juanitofatas](https://forum.buildkite.community/u/juanitofatas)
#### Post date: [April 19, 2021, 1:48am UTC](https://forum.buildkite.community/t/permissions-on-retry/1530/2 "2021-04-19T01:48:50Z")

</div>

Hello Ian,

Yes, it is possible to limit on who can retry by using Agent hooks (Agent hooks is our recommendation to enforce any security rules.):

> **[Securing your Buildkite Agent v3](https://buildkite.com/docs/agent/v3/securing#strict-checks-using-agent-hooks)**
>
> In cases where a Buildkite Agent is being deployed into a sensitive environment there are a few default settings and techniques which may be adjusted.

You can check `BUILDKITE_REBUILT_FROM_BUILD_ID` (empty string when not a rebuild) and `BUILDKITE_CREATOR_TEAMS` to see if it is a rebuild and if the user is in Admin teams.

Hope this helps!

Cheers,  
Juanito

---

<div class="post-metadata">

### Author: ![ianbrex](https://avatars.discourse-cdn.com/v4/letter/i/8c91f0/32.png) [@ianbrex](https://forum.buildkite.community/u/ianbrex)
#### Post date: [April 19, 2021, 4:56pm UTC](https://forum.buildkite.community/t/permissions-on-retry/1530/3 "2021-04-19T16:56:08Z")

</div>

That is something that might work for us. Thanks a lot!