diff --git a/gerrit/acls/openstack-dev/ci-sandbox.config b/gerrit/acls/openstack-dev/ci-sandbox.config
new file mode 100644
index 0000000000..42e5291575
--- /dev/null
+++ b/gerrit/acls/openstack-dev/ci-sandbox.config
@@ -0,0 +1,21 @@
+[access "refs/heads/*"]
+abandon = group Registered Users
+label-Code-Review = -2..+2 group Registered Users
+label-Verified = -1..+1 group Registered Users
+label-Workflow = -1..+1 group Registered Users
+
+[access "refs/heads/proposed/*"]
+abandon = group Registered Users
+label-Code-Review = -2..+2 group Registered Users
+label-Verified = -1..+1 group Registered Users
+label-Workflow = -1..+1 group Registered Users
+
+[access "refs/tags/*"]
+pushSignedTag = group infra-core
+
+[receive]
+requireChangeId = true
+requireContributorAgreement = true
+
+[submit]
+mergeContent = true
diff --git a/gerrit/projects.yaml b/gerrit/projects.yaml
index 73296a07cf..7ccb36f7cb 100644
--- a/gerrit/projects.yaml
+++ b/gerrit/projects.yaml
@@ -6,6 +6,8 @@
 - project: openstack-attic/python-melangeclient
 - project: openstack-dev/bashate
   description: A pep8 equivalent for bash scripts
+- project: openstack-dev/ci-sandbox
+  use-storyboard: true
 - project: openstack-dev/cookiecutter
   description: Cookiecutter Template for new OpenStack projects
   upstream: git://github.com/emonty/cookiecutter-openstack.git
diff --git a/zuul/layout.yaml b/zuul/layout.yaml
index 0d1461ab92..1e133c1a4d 100644
--- a/zuul/layout.yaml
+++ b/zuul/layout.yaml
@@ -2841,6 +2841,11 @@ projects:
       - name: publish-to-pypi
       - name: python-jobs
 
+  - name: openstack-dev/ci-sandbox
+    template:
+      - name: merge-check
+      - name: noop-jobs
+
   - name: openstack-dev/cookiecutter
     template:
       - name: merge-check