diff --git a/groups b/groups
index 181b3b5..e135ddc 100644
--- a/groups
+++ b/groups
@@ -3,6 +3,7 @@
 18cf7f27ecb1f1d727d16d5dfeaf019d9b9f5c83	Administrators
 6aa943a8d1abd393ddcd472d7f0d857acb942d46	aom-interns
 9f26ada1fdf1ae26de801eea0a9a69b37e70a151	aom-committers
+ca5c1c3492e3257adb0dc1b2caeb8a365e3a534f	gerrit-submit-requirements-admins
 global:Anonymous-Users                  	Anonymous Users
 global:Project-Owners                   	Project Owners
 global:Registered-Users                 	Registered Users
diff --git a/project.config b/project.config
index b7f34e5..82c4cb5 100644
--- a/project.config
+++ b/project.config
@@ -36,6 +36,7 @@
 	exclusiveGroupPermissions = read
 	read = group Administrators
 	read = group Project Owners
+	read = group gerrit-submit-requirements-admins
 	push = group Administrators
 	push = group Project Owners
 	label-Code-Review = -2..+2 group Administrators
@@ -79,12 +80,15 @@
 	pushMerge = deny group Registered Users
 [reviewer]
 	enableByEmail = true
+[access "refs/for/refs/heads/master"]
+	exclusiveGroupPermissions = addPatchSet push
 [capability]
 	administrateServer = group Administrators
 	createAccount = group mdb/gwsq
 	viewAllAccounts = group Registered Users
-[access "refs/for/refs/heads/master"]
-	exclusiveGroupPermissions = addPatchSet push
+[access "refs/for/refs/meta/config"]
+	push = group gerrit-submit-requirements-admins
+	read = group gerrit-submit-requirements-admins
 [plugin "uploadvalidator"]
 	blockedKeywordPattern = testfishiamfake
 	blockedKeywordPattern = (?i)\\bairbrush\\b