More Control Over Permissions in Bitbucket Pipelines: New Features and Upcoming Changes
Atlassian, Wednesday, November 4th, 2026
Atlassian adds step-level permissions and short-lived container tokens to Bitbucket Pipelines and outlines breaking permission changes through 2027.
Atlassian is introducing granular step-level permissions and container tokens in Bitbucket Pipelines to reduce reliance on long-lived credentials stored in pipeline variables.
Each step now gets a short-lived OAuth token, isolated to the build container and repository and valid only while the step runs, with permissions set via auth.system.scopes.
Repository admins can configure branch restrictions to trust pipelines from specific source branches, so release pipelines can push version bumps to main without bot user exemptions.
Breaking changes include a new pipeline:write scope for the Run a pipeline API, a November 30, 2026 change to branch restriction behavior, and the end of broad default step permissions on April 30, 2027.