Modify access rules

project.config

diff --git a/project.config b/project.config
index 11ce051..dc50b2e 100644
--- a/project.config
+++ b/project.config
@@ -5,25 +5,9 @@
 	requireSignedOffBy = false
 	requireChangeId = true
 	createNewChangeForAllNotInTarget = false
-[accounts]
-	sameGroupVisibility = deny group contributed-in-past
-	sameGroupVisibility = deny group google/google-union:signcla
-[contributor-agreement "Google CLA"]
-	description = Google Contributor License Agreement
-	agreementUrl = static/cla.html
-	accepted = group contributed-in-past
-	accepted = group google/google-union:signcla
-	accepted = group gophers
-	accepted = group ldap/employees
-	accepted = group ldap/interns
 [submit]
 	mergeContent = true
 	action = cherry pick
-[capability]
-	administrateServer = group admins
-	viewAccess = group gobot
-	viewAllAccounts = group gobot
-	gerrit-google-manageUsersGet = group gobot
 [access "refs/*"]
 	read = group Anonymous Users
 	create = group gerritbot
@@ -77,6 +61,7 @@
 [access "refs/tags/*"]
 	push = group may-force-push
 	push = group nobody
+	push = group release-managers
 	create = group may-force-push
 	create = group nobody
 	create = group release-managers
@@ -103,18 +88,6 @@
 	value = -1 TryBots failed
 	value = 0 No results
 	value = +1 TryBots succeeded
-[notify "codereviews"]
-	email = golang-codereviews@googlegroups.com
-	header = cc
-	filter = -project:scratch -message:do-not-review
-[notify "checkins"]
-	email = golang-checkins@googlegroups.com
-	header = to
-	type = submitted_changes
-	filter = -project:scratch
-[notify "gopherbot"]
-	email = gopherbot@pubsubhelper.golang.org
-	header = to
 [access "refs/for/*"]
 	addPatchSet = group Registered Users
 [commitmessage]
@@ -123,3 +96,31 @@
 [access "^refs/heads/release-branch.+"]
 	exclusiveGroupPermissions = submit
 	submit = group release-managers
+[accounts]
+	sameGroupVisibility = deny group contributed-in-past
+	sameGroupVisibility = deny group google/google-union:signcla
+[contributor-agreement "Google CLA"]
+	description = Google Contributor License Agreement
+	agreementUrl = static/cla.html
+	accepted = group contributed-in-past
+	accepted = group google/google-union:signcla
+	accepted = group gophers
+	accepted = group ldap/employees
+	accepted = group ldap/interns
+[capability]
+	administrateServer = group admins
+	gerrit-google-manageUsersGet = group gobot
+	viewAccess = group gobot
+	viewAllAccounts = group gobot
+[notify "checkins"]
+	header = to
+	email = golang-checkins@googlegroups.com
+	type = submitted_changes
+	filter = -project:scratch
+[notify "codereviews"]
+	header = cc
+	email = golang-codereviews@googlegroups.com
+	filter = -project:scratch -message:do-not-review
+[notify "gopherbot"]
+	header = to
+	email = gopherbot@pubsubhelper.golang.org