Resolve permission errors

Fix the permission error blocking deploy for the payroll service before the payroll run on Friday. On host app-payroll-01, grant deploy@ci the write permission on /var/apps/payroll/releases and ensure the deploy process can create the symlink current. After you change permissions, run a test deploy and report back if any files still deny access.

Before I send this permissions patch to the ops team, make it easy for them to accept. Show the minimal ACL change required, surface which user and group own the critical files, make the risky setuid or recursive chown calls obvious, and flag anything that would impact backups or existing running processes.

A deploy failed with permission denied on /var/apps/payroll/releases even though the directory is owned by root and I expected the deploy user to have group write. I'm the release engineer, the ops lead is Sean, and this payroll deploy must run Friday morning. I'm worried changing ownership will break auditing and that simply adding group write will open a security hole. I can't tell whether an unexpected umask, ACL, or SELinux policy is blocking write. What's the most likely cause and the safest next step to restore the deploy without opening a vulnerability?

We repeatedly waste time fixing permission errors on deploys; each time someone does a quick chmod -R and we get security reviews. I'm the platform engineer, Sean is the ops lead, and our deployment scripts are older than some team members. I suspect our lack of explicit ownership rules and absence of automated checks in CI cause this. What single change to our deploy process would prevent these recurring permission failures, and how should I enforce it?