diff --git a/db/migrate/20170309173138_create_protected_tags.rb b/db/migrate/20170309173138_create_protected_tags.rb
index c69ef9704109325b590151def17d7c2f35ae15fb..0079452914376aa48a19e6d9330d2b881d4e6ee6 100644
--- a/db/migrate/20170309173138_create_protected_tags.rb
+++ b/db/migrate/20170309173138_create_protected_tags.rb
@@ -4,36 +4,25 @@ class CreateProtectedTags < ActiveRecord::Migration
   # Set this constant to true if this migration requires downtime.
   DOWNTIME = false
 
-  GitlabAccessMaster = 40
+  GITLAB_ACCESS_MASTER = 40
 
   def change
     create_table :protected_tags do |t|
       t.integer :project_id, null: false
       t.string :name, null: false
-      t.string :timestamps #TODO: `null: false`? Missing from protected_branches
+      t.timestamps null: false
     end
 
     add_index :protected_tags, :project_id
 
-    create_table :protected_tag_merge_access_levels do |t|
-      t.references :protected_tag, index: { name: "index_protected_tag_merge_access" }, foreign_key: true, null: false
-
-      t.integer :access_level, default: GitlabAccessMaster, null: true #TODO: was false, check schema
-      t.integer :group_id #TODO: check why group/user id missing from CE
-      t.integer :user_id
-      t.timestamps null: false
-    end
-
     create_table :protected_tag_push_access_levels do |t|
       t.references :protected_tag, index: { name: "index_protected_tag_push_access" }, foreign_key: true, null: false
-      t.integer :access_level, default: GitlabAccessMaster, null: true #TODO: was false, check schema
-      t.integer :group_id
-      t.integer :user_id
+      t.integer :access_level, default: GITLAB_ACCESS_MASTER, null: true
+      t.references :user, foreign_key: true, index: true
+      t.integer :group_id#TODO: Should this have an index? Doesn't appear in brances #, index: true
       t.timestamps null: false
     end
 
-    #TODO: These had rubocop set to disable Migration/AddConcurrentForeignKey
-    # add_foreign_key :protected_tag_merge_access_levels, :namespaces, column: :group_id 
-    # add_foreign_key :protected_tag_push_access_levels, :namespaces, column: :group_id
+    add_foreign_key :protected_tag_push_access_levels, :namespaces, column: :group_id # rubocop: disable Migration/AddConcurrentForeignKey
   end
 end
diff --git a/db/schema.rb b/db/schema.rb
index 05b28b6a63ba42c2483074afb866197a01d81113..650b18bb013dc719856824e1988e3a92e014a593 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170317203554) do
+ActiveRecord::Schema.define(version: 20170315194013) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -963,28 +963,23 @@ ActiveRecord::Schema.define(version: 20170317203554) do
 
   add_index "protected_branches", ["project_id"], name: "index_protected_branches_on_project_id", using: :btree
 
-  create_table "protected_tag_merge_access_levels", force: :cascade do |t|
-    t.integer "protected_tag_id", null: false
-    t.integer "access_level", default: 40, null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-  end
-
-  add_index "protected_tag_merge_access_levels", ["protected_tag_id"], name: "index_protected_tag_merge_access", using: :btree
-
   create_table "protected_tag_push_access_levels", force: :cascade do |t|
     t.integer "protected_tag_id", null: false
-    t.integer "access_level", default: 40, null: false
+    t.integer "access_level", default: 40
+    t.integer "user_id"
+    t.integer "group_id"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
   end
 
   add_index "protected_tag_push_access_levels", ["protected_tag_id"], name: "index_protected_tag_push_access", using: :btree
+  add_index "protected_tag_push_access_levels", ["user_id"], name: "index_protected_tag_push_access_levels_on_user_id", using: :btree
 
   create_table "protected_tags", force: :cascade do |t|
     t.integer "project_id", null: false
     t.string "name", null: false
-    t.string "timestamps"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
   end
 
   add_index "protected_tags", ["project_id"], name: "index_protected_tags_on_project_id", using: :btree
@@ -1331,8 +1326,9 @@ ActiveRecord::Schema.define(version: 20170317203554) do
   add_foreign_key "project_statistics", "projects", on_delete: :cascade
   add_foreign_key "protected_branch_merge_access_levels", "protected_branches"
   add_foreign_key "protected_branch_push_access_levels", "protected_branches"
-  add_foreign_key "protected_tag_merge_access_levels", "protected_tags"
+  add_foreign_key "protected_tag_push_access_levels", "namespaces", column: "group_id"
   add_foreign_key "protected_tag_push_access_levels", "protected_tags"
+  add_foreign_key "protected_tag_push_access_levels", "users"
   add_foreign_key "subscriptions", "projects", on_delete: :cascade
   add_foreign_key "timelogs", "issues", name: "fk_timelogs_issues_issue_id", on_delete: :cascade
   add_foreign_key "timelogs", "merge_requests", name: "fk_timelogs_merge_requests_merge_request_id", on_delete: :cascade