diff --git a/gerrit/acls/openstack/openstack-ansible-security.config b/gerrit/acls/openstack/openstack-ansible-security.config
new file mode 100644
index 0000000000..85161e950e
--- /dev/null
+++ b/gerrit/acls/openstack/openstack-ansible-security.config
@@ -0,0 +1,18 @@
+[access "refs/heads/*"]
+abandon = group openstack-ansible-core
+abandon = group openstack-ansible-security-core
+create = group openstack-ansible-release
+label-Code-Review = -2..+2 group openstack-ansible-core
+label-Code-Review = -2..+2 group openstack-ansible-security-core
+label-Workflow = -1..+1 group openstack-ansible-core
+label-Workflow = -1..+1 group openstack-ansible-security-core
+
+[access "refs/tags/*"]
+pushSignedTag = group openstack-ansible-release
+
+[receive]
+requireChangeId = true
+requireContributorAgreement = true
+
+[submit]
+mergeContent = true
diff --git a/gerrit/projects.yaml b/gerrit/projects.yaml
index 803ac819eb..04e96b61b2 100755
--- a/gerrit/projects.yaml
+++ b/gerrit/projects.yaml
@@ -2824,7 +2824,6 @@
   groups:
     - openstack-ansible
   docimpact-group: openstack-ansible
-  acl-config: /home/gerrit2/acls/openstack/openstack-ansible.config
 - project: openstack/openstack-ansible-specs
   description: Design Specifications for OpenStack-Ansible
   groups: