Given that Copado is a Managed Package that is installed in a Production Org, all users that will be working with Copado must have a Salesforce License that at least grants them access to Managed Package objects.
The minimum Salesforce license required for any Copado user is the Company Community license.
- Metadata deployments: the Org Credentials of the source and destination Orgs must correspond to a user that has the "Modify All Data" permission, otherwise metadata deployments will fail for a lack of permissions.
- Data deployments: the Org Credentials of the source and destination Orgs must correspond to a user that has the "API Enabled" permission and access to the objects of which records are being deployed, otherwise data deployments will fail for a lack of permissions.
Strict Access To Production
Copado Users don't have to be System Administrators in Production nor they need to have access to Production data. You can remove access to restricted objects and fields, just like with any other user by using SFDC Profiles or Permission Sets.
If your Release Management or Development team has no access to Production at all, you can also install Copado in a "Tooling" Org (which is an empty Production Org). In this Tooling Org you can integrate all your Salesforce Orgs via an OAuth Authentication with the Org Credentials and, as usual, perform deployments between your different Orgs.
Click here for more information on Salesforce licenses and/or contact your Salesforce representative for further assistance regarding Salesforce licenses.