How to mange data access in a CICD pipeline for multiple users with different permissions
My general experience is that CI/CD tools don't support impersonation or claims based authentication well or at-all. In addition you probably want the CI/CD tool to have more access than your users, because you want them to only use the CI/CD tool to change things.  

The way I have handled this in the past, however, was as follows:


Have the pipeline call the API of the CI/CD to find out who ran the pipeline
Use this pipeline to look up the group's that the user is a member of this (i.e. in LDAP)
If the member is of the appropriate group, continue. If not abort the build.


It's quite important to abort rather than fail the build because then it differentiates between an invalid user running the build, and a valid using running a build which then fails.

Another approach would be to sync LDAP groups with your CI/CD platform, and set permissions that way, although that may not give you the granularity you want.