The deploy bot is locked out

AlertError from server (Forbidden): deployments "shop" is forbidden: User "system:serviceaccount:default:ci-bot" cannot patch resource "deployments" in API group "apps" in the namespace "default"

What broke

After a tidy-up of old access rules, every deploy from the pipeline fails.

Your job

Let ci-bot patch Deployments again, and still not delete them.