Rather than trying to assign some combination of predefined roles to accomplish what you are looking for, I would suggest defining a new role and assigning to it the privileges that you need. This documentation page has a guide on doing so: https://docs.intersystems.com/iris20241/csp/docbook/Doc.View.cls?KEY=GSA...

That being said, is there something that your users need to do that is not covered by the %EnsRole_Administrator role?

For more details on the Interoperability > Manage > Deployment Changes category, both the 'Deploy' and 'History' options are controlled by the %Ens_Deploy resource, so your users would need a role with Use on %Ens_Deploy. You can see what resources control a given item in the management portal by clicking on the whitespace next to the item and viewing the 'System Resource(s)' and 'Custom Resource' listings. For more information on resources and privileges, see this documentation: https://docs.intersystems.com/iris20241/csp/docbook/Doc.View.cls?KEY=GSA... . So, any role with %Ens_Deploy, e.g. %EnsRole_Administrator, should give you access.

I hope this helps!

I'm not sure about TABLOCK specifically, but there are a couple other features that might help you solve this:

First, there is the LOCK TABLE statement: https://docs.intersystems.com/iris20241/csp/docbook/Doc.View.cls?KEY=RSQ...

There's also the objectscript LOCK command: https://docs.intersystems.com/iris20241/csp/docbook/Doc.View.cls?KEY=RCO...

You could use either of these to block the method while other instances of it are running and prevent the race condition. I'm not sure how efficient this method would be compared to TABLOCK, but it would fix the bug.

I hope this helps!