Our Gitlab structure is fairly simply. Our master is Production, we branch out for Sandbox and ask contracted developers to fork.