Reference
Roles and permissions
A role decides what someone may do on a project. Every permission, who holds it by default, and where it's checked.
Roles
| Role | Summary |
|---|---|
| Owner | Holds every permission. An owner's permissions can't be turned off. |
| Builder | Proposes and approves changes. Holds the permissions an owner gives builders. |
| Viewer | Reads everything and comments. Holds no permissions and changes nothing. |
A person is known by their GitHub account. A project belongs to one organization, and a role is held per project.
What every role can do
| Action | Owner | Builder | Viewer |
|---|---|---|---|
| Read the spec, changes, runs and history | Yes | Yes | Yes |
| Comment | Yes | Yes | Yes |
| Propose a change | Yes | Yes | No |
| Approve someone else's change | Yes | Yes | No |
| Invite people and change roles | Yes | No | No |
| Change permissions | Yes | No | No |
Permissions an owner can change
Each row can be turned on or off for builders on the Team screen. These are the defaults for a new project.
| Permission | Lets someone | Builders by default |
|---|---|---|
| Approve own change | Approve a change they started. | On |
| Approve own drift | Approve the drift change their own push opened. | Off |
| Promote to prod | Approve a held release for production. | Off |
| Revert | Revert a change's pull requests. | On |
| Secrets | Write and rotate secrets. | Off |
| Infra | Roll back, restart a service or run a job. | Off |
| MCP tokens | Connect an outside agent, such as Claude Code. | On |
| Agent settings | Change agent rules and settings, apply Manage changes, and answer a gate with Always or Never. | Off |
| Prod traces | Read the data kept in production traces. | Off |
Other project rules
| Rule | Default |
|---|---|
| Approvals a line needs before it lands | 1 |
| Who may promote to prod when every holder of that permission is away | Nobody |
Where permissions are checked
Every permission is checked where the action happens, by the service that does it, never only on the screen.
- Approve and Approve all ask the change service, which looks up the change, who started it, who pushed it if it's drift, and every review.
- Promote asks for the Promote to prod permission.
- A Manage change needs Agent settings to apply.
- Writing a secret needs Secrets.
When someone without a permission tries, Babbit refuses and tells them to ask an owner. When someone clicks Request changes, the change can't land until that person approves it again.
People who leave
Someone removed from a project stays listed as left, so their past approvals still name them. They hold no role anywhere: an approval, a token or a gate answer from them is refused.
The audit log
Every change to the organization, memberships, permissions and invites is a row in an audit log that only grows: it refuses updates and deletes. Each permission row on Team shows who last set it and when.
Related
- Invite your team and set roles: the steps on screen.
- Security guarantees: the mechanism.