Set file and directory permissions

I need these project folders and deploy scripts locked down before the release. Set ownership so that deploy@infra is the owner of /srv/project and /srv/project/shared, make the group devs for both, give owner rwx, group rwx on directories, owner rw and group r on files, ensure the sticky bit on /srv/project/shared so uploads by devs stay theirs, and verify with a recursive listing before and after. Deadline: Thursday noon.

Before I hand this to the audit team, make it obvious what changed and why. Put the effective permissions for /srv/project and /srv/project/shared at the top, call out any files that will lose write access for a user in group ops, list commands you will run and the single line that reverses each change, and flag any world-writable files that remain.

I just set permissions recursively on /srv/project to tighten security; the CI pipeline that writes build artifacts to /srv/project/shared started failing. The deploy owner should have access and devs must be able to upload, but I’m not sure which files CI needs to write or whether ACLs were in place. What likely permission or ownership mistake did I make, how do I check the minimal fix without reverting everything, and what single commands restore CI write access safely so I can test?

Every release I end up doing a permission sweep because services or CI lose write access; it costs hours and risks outages. I want a repeatable habit so deploys don’t morph ownership or break writers. Where am I most likely going wrong — umask, deploy user, group membership, or mixing chmod and ACLs — and what two changes should I make to stop this cycle permanently?