First, lets start out with “there is no on line provider that allows per brach access control lists as part of its base service.” It doesn’t exist as such.

What does exist, is the ability to do add commit hooks. For example, in git you could put a pre-receive hook on the server. This hook would check to see if the person doing the commit is one of the authorized committers for the branch and reject it if not. This doesn’t imply any sort of centralized server and it appears that github (for example) doesn’t do arbitrary pre-receive hooks. You could do this in house with a git server – just say “that one there is the master of masters” and go from there.

Lets instead look at what you are trying to accomplish. You want some people to be able to commit to a specific area of code that gets published to production. You could do this on github by setting access levels on the repo and having the devs be part of the write access team for that repo and the designers be part of the read access team. The designers would then fork the repo (which then they would have access to) and submit pull requests to the main repo for changes that are moved in. How staging and production are handled from this is an implementation detail.

On the other hand, if you are willing to shell out some money (you would if you are going for a github organization with private repos…) you may wish to look at Atlasssian Stash (I’m surprised this wasn’t considered given you are already using another atlassian product).

Atlasssian stash claims under its “enterprise: security” blurb:

Stash’s permissions levels make sure that the right people always have access to the right code. The simple yet powerful user interface makes it easy to manage permissions.

Set high-level global permissions, then fine tune them at the project, repository, or even branch levels with read/write/admin restrictions.

And, well, thats what you are describing you want. Stash is in essence an enterprise grade in house bitbucket server. As your enterprise is less than 10 users, the pricing for this is $10. Not $10/month, or $10/user. $10. Which is fairly hard to beat as a price.

So set up your branches, set who can commit to them, set up the pull request / code review feature and approval conditions or however you want the workflow to work and do it. For such a small organization I’d really be looking at stash as a viable alternative, especially if you aren’t already tied to other incompatible systems (a former employer considered it, but was already integrated with how github issues worked and so that didn’t go anywhere).