Add some details from https://about.gitlab.com/2014/11/26/keeping-your-code-protected/:

Who can:
* Force push to non-protected branches
* Force push to protected branches 
* Remove protected branches