diff --git a/gerrit/acls/openstack-infra/requestsexceptions.config b/gerrit/acls/openstack-infra/requestsexceptions.config
new file mode 100644
index 0000000000..6bbc3a3cf1
--- /dev/null
+++ b/gerrit/acls/openstack-infra/requestsexceptions.config
@@ -0,0 +1,13 @@
+[access "refs/heads/*"]
+abandon = group requestsexceptions-core
+label-Code-Review = -2..+2 group requestsexceptions-core
+label-Workflow = -1..+1 group requestsexceptions-core
+
+[access "refs/tags/*"]
+pushSignedTag = group requestsexceptions-release
+
+[receive]
+requireChangeId = true
+
+[submit]
+mergeContent = true