Roles & permissions

codingassist.bot uses a hierarchical role model at the tenant (organization) level. Roles are inclusive: Owner ⊇ Admin ⊇ Member — an Owner can do everything an Admin can, and an Admin everything a Member can.

Owner

The highest role — exactly one per tenant. Exclusive responsibilities:

• Manage billing (change plan, payment method, buy tokens).
• Delete the tenant or transfer ownership to another member.
• Configure sensitive integrations (Key Vault, BYOK AI keys, webhook secrets).

Admin

Operational administration — without access to billing or tenant deletion.

• Invite, remove and promote members (except transferring Owner).
• Connect / disconnect repositories (Azure DevOps).
• Configure the Azure DevOps PAT and webhook secrets.
• Choose the AI mode (managed Platform AI or BYOK) and per-agent models.
• Set the tenant-level .praxiom.yml.
• View all reviews and the audit log.

Member

The default role for a developer added to the tenant.

• View reviews and findings for repos they can access on the SCM side.
• Interact on PRs: use commands (@codingassist explain / fix), resolve or dismiss findings.
• Push a repo-level .praxiom.yml via a PR (merged onto the tenant config).
• Manually trigger a re-review on a PR they can access.

Permission matrix

allowed · denied · limited to the scope the user can access on the SCM

Related

• Members & invitations
• Billing