[itsm] Link CI with ro permissions