This role is used for pushes to try, and is currently allowing access to a private docker image. I'm not sure what the plan is for this image? Please link as necessary to other related bugs!
Ah, per Greg, I just moved docker-worker:capability:device:phone docker-worker:image:taskclusterprivate/tester-device:* queue:create-task:aws-provisioner-v1/testdroid-device to moz-tree:level:2, so they're no longer accessible from try. I think that's enough for now.