diff --git a/aptly-promote-pipeline.groovy b/aptly-promote-pipeline.groovy
index 7c7f492..6be2794 100644
--- a/aptly-promote-pipeline.groovy
+++ b/aptly-promote-pipeline.groovy
@@ -28,6 +28,13 @@
 timeout(time: 12, unit: 'HOURS') {
     node("docker&&hardware") {
         try {
+            if ("testing" in TARGET && !jenkinsUtils.currentUserInGroup(["release-engineering", "aptly-promote-users"])) {
+                insufficientPermissions = true
+                throw new Exception("Only release-engineering or aptly-promote-users can perform promote to testing.")
+            } else if (!jenkinsUtils.currentUserInGroup(["release-engineering"])) {
+                insufficientPermissions = true
+                throw new Exception("Only release-engineering team can perform promote.")
+            }
             stage("promote") {
                 // promote is restricted to users in aptly-promote-users LDAP group
                 if(jenkinsUtils.currentUserInGroups(["mcp-cicd-admins", "release-engineering", "opencontrail-all"])){