Guides
Invite your team and set roles
A project has three roles: owner, builder and viewer. This guide covers invites, roles, the permissions an owner can change, and what happens when someone leaves.
Before you begin
You need to be an owner of the project to invite people and change permissions. Builders can see the Team screen but can't change it.
Roles
| Role | Can |
|---|---|
| Owner | Everything: propose, approve, promote to production, manage secrets, the team and agent settings. Owners hold every permission, always. |
| Builder | Propose changes and approve them, revert, and connect outside agents. By default, builders can't approve their own drift, promote to production or manage secrets. |
| Viewer | Read everything and comment. A viewer's comment is an input: it counts when a change answers it. |
The full list of permissions and their defaults is in Roles and permissions.
Invite someone
- Open your profile menu and choose Team.
- Click Invite.
- Enter the person's email address.
- Choose a role.
- Choose how long the invite lasts: 1, 7 or 30 days.
- Click Create link. Babbit copies the link.
- Send the link to the person yourself.
An invite is for one person. The link works only when that person opens it, signed in to GitHub with a verified email address that matches. If anyone else opens the link, or it has expired or been used, nobody joins, and the page says why in one line.
Invites appear under the team grid with their role and days left.
Change someone's role
- On Team, click the person's role.
- Choose the new role.
The change takes effect at once. The row's audit line records who changed it and when.
Change what a role may do
The lower half of Team lists what each role may do. The first rows, such as propose, approve and manage the team, are fixed for each role. The rest are settings an owner can change:
- Find the permission's row, such as Promote to prod.
- Click the light under Builder to turn the permission on or off for builders.
Owners keep every row, and viewers change nothing. Every permission is checked where the action happens, not only on the screen. When someone without a permission tries, a message tells them to ask an owner.
Remove someone
Removing someone is a change to the team, not a delete.
- On Team, open the person's role menu.
- Choose to remove them.
- Confirm.
The person stays on the list as left, so their past approvals still name them. They lose every role at once: an approval, a token or a gate answer from them is refused from then on. Babbit lists the secrets they entered so you can rotate them.
Related
- Roles and permissions: every permission and its default.
- Security guarantees: how permissions are enforced.