Roles and permissions

cubic uses a role-based access control system to manage who can make changes to your team’s subscription and settings. Every team member has one of three roles:

​

Permissions matrix

​

Seats and roles

Seats and roles are related, but they control different things.

• Seats control which GitHub users are assigned cubic access and how usage is counted for billing.
• Roles control what a seated user can change inside cubic.

Bot rows can be enabled so bot-authored PRs receive AI reviews without adding a paid developer seat. Those reviews still use the team’s normal reviewed-line allowance. Members and viewers can both use cubic surfaces available to their seat. The difference is configuration access: members can change non-billing workspace and repository settings, while viewers can only read them. Repository and PR visibility can still depend on GitHub repository access. If someone cannot see a specific repository or PR, confirm that they have access to the repository in GitHub and that cubic has access to that repository.

​

How to become an admin

There are three ways to become a cubic admin:

1. Install the cubic GitHub app. When you install cubic for your GitHub organization, you automatically become an admin.
2. Be a GitHub organization admin. GitHub organization admins automatically become cubic admins when the app is installed.
3. Get promoted by an existing admin. Any current admin can promote you through Members settings.

At least one admin is required for every team. Admins cannot remove their own admin role, and cubic prevents changes that would leave the team without an active human admin. Bot accounts cannot be admins. The default role for new seats is Member unless the user qualifies for admin during setup.

​

Admin role

Admins have full control over team management and can:

• Manage seat assignments: Add or remove cubic seats for team members
• Manage roles: Change members between admin, member, and viewer roles (note: bot accounts cannot be admins)
• Configure workspace settings: Change AI review settings, repository settings, integrations, scan settings, and billing automation
• Configure auto-assign: Give a seat to developers who join the GitHub organization or open their first PR, and remove seats when members leave the GitHub organization
• Manage billing: Update plans, seats, and subscription controls

​

Member role

Members can use cubic’s full feature set and edit non-billing settings:

• Full platform access: Use all cubic features including AI reviews, analytics, and PR management
• Manage workspace settings: Configure AI review behavior, repository settings, integrations, scan settings, and other non-billing team settings
• View billing status: See subscription status and billing-related information without changing billing details
• No seat, role, or billing management: Cannot assign/remove seats, change user roles, or manage billing and subscription controls

​

Viewer role

Viewers can use cubic’s review and analytics surfaces, but they cannot change cubic settings:

• View team information: See team members, role assignments, subscription status, and settings
• Use review surfaces: Access PR review, analytics, and other non-settings views available to their seat
• No configuration changes: Cannot change AI review settings, repository settings, integrations, seats, roles, or billing controls

​

How to manage user roles

Only admins can change user roles. To promote or demote a user:

1. Navigate to Settings → Members
2. Find the team member in the list, or search for them with Search people
3. Click the row menu (⋯) and choose Change role
4. Select the new role: Admin, Member, or Viewer
5. The change takes effect immediately

​

Manage roles through the API

Use the Members API to list members and update their seats and roles from your own scripts. With your personal API key, the API uses the same role permissions as the app. Admins create organization API keys in Settings → API, CLI & MCP, with read or admin access. A read key can read members, and an admin key can also update their seats and roles like an admin. Each key works only in its own organization and cannot change billing or the subscription. Updates need an organization admin or an organization key with admin access, and an active Team, Pro, or Max subscription billed through cubic.

​

FAQ

​

Troubleshooting

​

I need someone to edit settings, but not billing

Give them the Member role. Members can edit non-billing settings, but they cannot manage seats, roles, or billing.

​

A user can view settings but cannot save changes

Check their role. Viewers can read settings but cannot change AI review settings, repository settings, integrations, seats, roles, or billing controls.

​

I cannot demote myself from admin

cubic prevents admins from removing their own admin role. Ask another admin to change your role after confirming that the team will still have at least one admin.

​

I cannot remove or demote the last admin

Every team needs at least one active human admin. Add or promote another admin first, then change the original admin’s role or seat.

​

I cannot make a bot an admin

Bot accounts cannot be admins. Assign bot seats a non-admin role instead.