"External status checks" can be accepted by users below developer access if the user is either author or assignee of the target merge request

Any user who is either author or assignee of a merge request can approve that merge request's `external status checks`. This includes users with `Guest` access that creates MR's either through email or through a fork of the project. It also includes users with `Guest` or `Reporter` access getting …

describe 'permissions' do
    before do
      stub_licensed_features(external_status_checks: true)
    end

    it { expect { subject }.to be_allowed_for(:maintainer).of(project) }
    it { expect { subject }.to be_allowed_for(:developer).of(project) }
    it { expect { subject }.to …