diff --git a/groups b/groups
new file mode 100644
index 0000000..b7d58a5
--- /dev/null
+++ b/groups
@@ -0,0 +1,8 @@
+# UUID                                  	Group Name
+#
+3c602ebb948eaf2077cc2eb062eb1a3b0367d759	Service Users
+573bd73ee08f31e499ad7746a96ece2b2d47e06d	ts-devs
+global:Anonymous-Users                  	Anonymous Users
+global:Project-Owners                   	Project Owners
+global:Registered-Users                 	Registered Users
+336611fbffa67594c63fba9b5309b56940944c54	ts-maintainers
diff --git a/project.config b/project.config
index e080951..a5c4068 100644
--- a/project.config
+++ b/project.config
@@ -1,4 +1,103 @@
 [access]
 	inheritFrom = All-Projects
 [submit]
-	action = rebase if necessary
+	action = inherit
+	rejectEmptyCommit = true
+[receive]
+	requireSignedOffBy = true
+	rejectImplicitMerges = true
+	requireChangeId = true
+[project]
+	description = Access controls for the tf.org/ts namespace
+
+[access "refs/*"]
+	read = group Service Users
+
+[access "refs/heads/*"]
+	abandon = group ts-maintainers
+	create = group ts-maintainers
+	editTopicName = group ts-maintainers
+	forgeAuthor = group ts-maintainers
+	forgeCommitter = group ts-maintainers
+	forgeServerAsCommitter = group ts-maintainers
+	push = +force group ts-maintainers
+	pushMerge = group ts-maintainers
+	submit = group ts-maintainers
+	submitAs = group ts-maintainers
+
+	label-Code-Review = -1..+1 group Registered Users
+	label-Code-Owner-Review = -1..+1 group ts-maintainers
+	label-Maintainer-Review = -1..+1 group ts-maintainers
+
+	label-Verified = -1..+1 group ts-maintainers
+
+[access "refs/meta/config"]
+	read = group ts-maintainers
+	create = group ts-maintainers
+	push = group ts-maintainers
+	submit = group ts-maintainers
+	label-Code-Review = -2..+2 group ts-maintainers
+
+[access "refs/meta/dashboards/*"]
+	create = group ts-maintainers
+	push = group ts-maintainers
+
+[access "refs/tags/*"]
+	create = group ts-maintainers
+	createTag = group ts-maintainers
+	createSignedTag = group ts-maintainers
+
+[access "refs/heads/topics/*"]
+	abandon = group ts-devs
+	forgeAuthor = group ts-devs
+	forgeCommitter = group ts-devs
+	push = group ts-devs
+	pushMerge = group ts-devs
+	create = group ts-devs
+
+[access "refs/for/refs/heads/topics/*"]
+	abandon = group ts-devs
+	forgeAuthor = group ts-devs
+	forgeCommitter = group ts-devs
+	push = +force group ts-devs
+	pushMerge = group ts-devs
+
+# The Code-Review label is purely informational. Contributors that are neither
+# code owners for the patch nor maintainers use it to record their concerns.
+[label "Code-Review"]
+	function = NoBlock
+	value = -1 I would prefer this is not merged as is
+	value = 0 No score
+	value = +1 Looks good to me
+	copyAllScoresIfNoCodeChange = true
+	copyAllScoresOnTrivialRebase = true
+	defaultValue = 0
+
+# In addition, define our 2 custom labels for code review.
+# These influence whether a patch is submittable.
+[label "Code-Owner-Review"]
+	function = MaxWithBlock
+	value = -1 I would prefer this is not merged as is
+	value = 0 No score
+	value = +1 Looks good to me
+	copyAllScoresIfNoCodeChange = true
+	copyAllScoresOnTrivialRebase = true
+	defaultValue = 0
+
+[label "Maintainer-Review"]
+	function = MaxWithBlock
+	value = -1 I would prefer this is not merged as is
+	value = 0 No score
+	value = +1 Looks good to me
+	copyAllScoresIfNoCodeChange = true
+	copyAllScoresOnTrivialRebase = true
+	defaultValue = 0
+
+[label "Verified"]
+	function = MaxWithBlock
+	value = -1 Fails
+	value = 0 No score
+	value = +1 Verified
+	copyAllScoresIfNoCodeChange = true
+	copyAllScoresOnTrivialRebase = true
+	defaultValue = 0