Skip to content

Add documentation for RBAC #379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Jun 12, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Let's call them just "roles", dropping all the "RBAC" references.
Add links to this page from the What's-Next sections of other pages.
  • Loading branch information
jmacdotorg committed Jun 4, 2025
commit 44a8b82ceed5b92b7a96a8e65d7f4560825c63f7
4 changes: 4 additions & 0 deletions docs/getting-started/adding-organizations.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,7 @@ This will grant CodeRabbit access to the selected organization, allowing it to:
- Access user email addresses (read-only)

> Note: Organizations control which applications are allowed to access their private data. You may need organization admin approval to complete this process.

## What's next {#whats-next}

- [Manage your subscription](/getting-started/subscription-management)
4 changes: 4 additions & 0 deletions docs/getting-started/subscription-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,3 +57,7 @@ To modify the number of seats in your subscription:
![Changing your plan](../../static/img/getting-started/edit-subscription.png)

![Changing your plan](../../static/img/getting-started/change-seats.png)

## What's next {#whats-next}

- [Control administrative access](/guides/roles)
50 changes: 25 additions & 25 deletions docs/guides/rbac.md → docs/guides/roles.md
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
---
title: Control administrative access
description: Using the role-based authorization feature (RBAC) of CodeRabbit
description: Using the role-based authorization features of CodeRabbit
---

You can control which CodeRabbit
administrative features are available to your organization's user accounts by using
role-based access control (RBAC).
administrative features are available to your organization's user accounts by
assigning and updating account roles.

## Overview of CodeRabbit RBAC {#overview}
## Overview of CodeRabbit roles {#overview}

Every CodeRabbit account has exactly one RBAC role for each organization
Every CodeRabbit account has exactly one role for each organization
that account is associated with.
For example, if you belong to two GitHub-based organizations that use
CodeRabbit, then you have one CodeRabbit RBAC role set for each of those two
CodeRabbit, then you have one CodeRabbit role set for each of those two
organizations.

CodeRabbit RBAC roles determine your ability to read or change various
CodeRabbit roles determine your ability to read or change various
billing, account management, and other administrative functions related to
an organization. The roles are as follows:

Expand All @@ -25,74 +25,74 @@ an organization. The roles are as follows:
- **Billing Admin**: allows read/write access to features specific
to a subscription and billing management, and limited access to other administrative features.

CodeRabbit users with the **Admin** role can modify the RBAC roles of other users in the
CodeRabbit users with the **Admin** role can modify the roles of other users in the
organization.

For a complete list of the administrative functions available to each role, see
[Role permissions](#permissions).

### CodeRabbit roles and Git platform roles {#and-upstream}

Modifying an account's CodeRabbit RBAC role doesn't have any "upstream"
Modifying an account's CodeRabbit role doesn't have any "upstream"
effect on that account's role or permissions in your organization's Git platform.
Similarly, changes to an account's role on your organization's Git platform don't
affect that account's CodeRabbit RBAC role.
affect that account's CodeRabbit role.

For example, if you have CodeRabbit integrated with a GitHub organization, and you change an account's CodeRabbit role from **Member** to **Admin**, then that account's
permission or ownership level with your GitHub organization doesn't change as a result.

### CodeRabbit roles and developer features {#and-features}

CodeRabbit RBAC roles affect only access to administrative features. Roles have no effect on using CodeRabbit developer features, such as automated code reviews.
CodeRabbit roles affect only access to administrative features. Roles have no effect on using CodeRabbit developer features, such as automated code reviews.

For example, if an organization has a Pro-tier
CodeRabbit account, then any user account with a seat assigned to it can use Pro-tier features with the organization's private repositories, regardless of that account's RBAC role.
CodeRabbit account, then any user account with a seat assigned to it can use Pro-tier features with the organization's private repositories, regardless of that account's role.

For more information on seat and subscription management, see [Manage your subscription](/getting-started/subscription-management).

## Default RBAC roles {#defaults}
## Default roles {#defaults}

CodeRabbit assigns every user account in your organization a default RBAC role,
CodeRabbit assigns every user account in your organization a default role,
using the following metrics:

- If a user has an ownership-level role with the Git platform organization—for example,
**Admin** on GitHub, or **Owner** on Bitbucket—then that user receives the default
CodeRabbit RBAC role of **Admin**.
- Otherwise, the user receives the **Member** RBAC role by default.
CodeRabbit role of **Admin**.
- Otherwise, the user receives the **Member** role by default.

You can update a user's role from its default setting by following the steps detailed in the next section. This requires that your own account
has an **Admin** RBAC role with the organization.
has an **Admin** role with the organization.

CodeRabbit applies these defaults only when initially setting up RBAC for an
CodeRabbit applies these defaults only when initially setting up for an
account within an organization. Subsequent "upstream" role changes don't affect
an account's CodeRabbit role.

## View or set RBAC roles {#how-to}
## View or set roles {#how-to}

You can view and set RBAC roles from the CodeRabbit dashboard, as detailed in the
You can view and set roles from the CodeRabbit dashboard, as detailed in the
following sections.

### View roles {#view-roles}

To view a list of your organization's RBAC role assignments, follow these steps:
To view a list of your organization's role assignments, follow these steps:

1. Go to the [CodeRabbit dashboard](https://app.coderabbit.ai/settings/repositories).
1. At the top of the sidebar, select the organization whose user roles you want to view.
1. On the sidebar, click **Subscription**.

This displays a table of all of the CodeRabbit **Admin** and **Member** accounts associated with the selected
organization. In this table, the **Role** column displays the CodeRabbit RBAC role for
organization. In this table, the **Role** column displays the CodeRabbit role for
each account.

To view a list of accounts with the **Billing Admin** role, click the **Billing Admins** tab located above the table of user accounts.

### Set roles {#set-roles}

:::note
To modify users' CodeRabbit accounts, your own account must have the **Admin** RBAC role within your organization.
To modify users' CodeRabbit accounts, your own account must have the **Admin** role within your organization.
:::

To change a user account's RBAC role, follow these steps:
To change a user account's CodeRabbit role, follow these steps:

1. Go to your organization's list of user accounts, as detailed in the previous section.
If you have the **Admin** role within this organization, then the **Role** column in the user accounts table contains selectable menus.
Expand All @@ -115,7 +115,7 @@ This sends an email to the address that you specified. After the recipient compl
## Role permissions {#permissions}

The following table lists the CodeRabbit administrative functionality
available to each of the CodeRabbit RBAC roles.
available to each of the CodeRabbit roles.

| Resource | Admin | Member | Billing Admin |
| ----------------------- | ---------- | --------- | ------------- |
Expand Down
4 changes: 2 additions & 2 deletions sidebars.ts
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ const sidebars: SidebarsConfig = {
type: "category",
collapsed: true,
label: "Manage your account",
items: ["getting-started/subscription-management", "guides/rbac"],
items: ["getting-started/subscription-management", "guides/roles"],
},
{
type: "category",
Expand All @@ -83,7 +83,7 @@ const sidebars: SidebarsConfig = {
"integrations/knowledge-base",
"guides/review-instructions",
"tools/tools",
"guides/rbac",
"guides/roles",
],
},
{
Expand Down