> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Choose an approval policy

> Combine Automatic Approvals, risk limits, GitHub branch rules, and Triage to decide who approves and merges each pull request.

GitHub (This feature is available on GitHub and GitHub Enterprise.) | Essentials Plan (This feature is available on Essentials (formerly Pro), Team (formerly Pro+), Advanced, and Enterprise. Please refer to our pricing page for more information about our plans and features.)

Three separate settings decide what happens to a pull request before it merges:

| Question | Decided by |
| - | - |
| Does CodeRabbit add an approving review? | [Automatic Approvals](https://docs.coderabbit.ai/pr-reviews/automatic-approvals.md) and its [risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md) |
| How many approvals does the pull request need, and from whom? | Your GitHub branch rules |
| Does CodeRabbit merge the pull request? | [Triage rules](https://docs.coderabbit.ai/triage/rules.md) |

This guide shows how to combine them so that routine pull requests move quickly and higher-risk ones get human review. The steps use GitHub.

## An approval is not a merge

CodeRabbit's approval counts as one approving review and does nothing else. A pull request can merge only when it meets every GitHub requirement, such as required status checks, other required reviews, code owner reviews, and no merge conflicts. Automatic Approvals does not fix those problems or merge the pull request. Whoever merges it, a person, GitHub auto-merge, or a Triage merge rule, still has to meet the same requirements.

## Choose a policy

The policies below assume that CodeRabbit is the only bot that submits approving reviews. If other bots approve too, their approvals may count toward the same requirement.

| Policy | CodeRabbit | Required approvals in GitHub | Who can approve |
| - | - | - | - |
| [CodeRabbit or a person](#coderabbit-or-a-person) | Automatic Approvals on | 1 | CodeRabbit or one person |
| [CodeRabbit plus a person](#coderabbit-plus-a-person) | Automatic Approvals on | 2 | CodeRabbit and one person, or two people |
| [People for higher-risk changes](#people-for-higher-risk-changes) | Automatic Approvals on, with a merge risk limit | 2 | CodeRabbit and one person when Merge Risk is within the limit; two people otherwise |
| [People only](#people-only) | Automatic Approvals off | 1 or more | People only |

A required approval count does not say who must approve. Two required approvals can always come from two people, so these policies never make CodeRabbit's approval mandatory. To require a review from a specific team, add [code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) and turn on **Require review from Code Owners**.

### CodeRabbit or a person

Use this policy when a clean CodeRabbit review is enough for the pull request to merge. Require **one approval** in GitHub and turn on Automatic Approvals:

```yaml .coderabbit.yaml theme={null}
reviews:
  auto_approvals:
    enabled: true
```

CodeRabbit approves once its [approval requirements](https://docs.coderabbit.ai/pr-reviews/automatic-approvals.md#approval-requirements) are met, or a person approves instead.

With a single required approval, an author's `@coderabbitai approve` comment can satisfy the requirement without a completed review of the latest commit or passing Pre-Merge Checks. To stop authors from doing this on their own pull requests, set `reviews.allow_author_approval: false`. See [Approve or resolve on demand](https://docs.coderabbit.ai/pr-reviews/automatic-approvals.md#approve-or-resolve-on-demand).

### CodeRabbit plus a person

Use the same CodeRabbit configuration, but require **two approvals** in GitHub. A CodeRabbit approval then leaves one approval for a teammate. Two people can also approve the pull request without waiting for CodeRabbit.

### People for higher-risk changes

Require **two approvals** in GitHub and add a [merge risk limit](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#set-a-merge-risk-limit):

```yaml .coderabbit.yaml theme={null}
reviews:
  auto_approvals:
    enabled: true
    max_merge_risk: low
```

When a pull request's [Merge Risk](https://docs.coderabbit.ai/pr-reviews/merge-risk.md) is Minimal or Low, CodeRabbit can approve it, and one person completes the pair. When Merge Risk is Moderate or above, or [unavailable](https://docs.coderabbit.ai/pr-reviews/merge-risk.md#when-merge-risk-is-unavailable), CodeRabbit [withholds its approval](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#when-coderabbit-withholds-approval) and two people must approve.

For example, a pull request has its review comments resolved but Moderate Merge Risk. Marking threads resolved does not change the rating; it changes only when a later review finds the risk addressed in the code. Two people can review the remaining risk and approve, or the author can change the code and let CodeRabbit review the new commit.

To give some teams or parts of the codebase a wider or stricter limit, add [overrides for teams and paths](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md#set-different-limits-for-paths). GitHub still requires the same number of approvals for everyone.

### People only

[Turn off Automatic Approvals](https://docs.coderabbit.ai/pr-reviews/automatic-approvals.md#turn-off-automatic-approvals) and set the number of required approvals you want. Turning the feature off stops new approvals but leaves CodeRabbit's existing approvals on open pull requests. Dismiss them before you rely on people-only approval.

## Configure GitHub

A repository administrator sets the approval requirement in GitHub, separately from CodeRabbit:

**1. Open the branch rules**

In the repository, go to **Settings → Rules → Rulesets**, then create or edit a branch ruleset and select the branches it protects. For classic branch protection, go to **Settings → Branches** instead.

**2. Require approvals**

Turn on **Require a pull request before merging**, then turn on required approvals and set the count for your policy.

**3. Dismiss stale approvals**

Turn on **Dismiss stale pull request approvals when new commits are pushed**, so that approvals do not carry over to changed code. CodeRabbit approves again after it reviews the new commit. Add code owner reviews and required status checks where you need them.

**4. Enforce the rule**

For a ruleset, set its enforcement status to **Active** and check its bypass list if the rule should also apply to administrators and automation. For classic branch protection, turn on **Do not allow bypassing the above settings**. Save the rule.

See GitHub's documentation on [branch protection rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) and [ruleset settings](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-a-pull-request-before-merging) for all available controls.

## Automate merging with Triage

Your approval policy decides who must approve a pull request. A Triage merge rule decides which pull requests CodeRabbit merges for you. The two can differ on purpose. For example:

* Lower-risk changes need CodeRabbit and one person, and higher-risk changes need two people, as in [People for higher-risk changes](#people-for-higher-risk-changes).
* A Triage rule based on the **Merge low-risk changes** template merges only a narrower set: open pull requests with low risk and low review effort.
* Higher-risk pull requests are merged deliberately by a person after human review.

A Triage merge rule merges only after the required checks and reviews pass, so it cannot merge a pull request that is still waiting for human approval. Its conditions control only that rule. They do not stop anyone from merging the pull request another way once the repository's requirements are met.

Triage's **Risk** condition is a [separate score](https://docs.coderabbit.ai/pr-reviews/merge-risk.md#related-assessments), so a pull request can be low risk in Triage and still above your merge risk limit. Choose each setting for its own purpose: risk limits protect the review requirement, and Triage conditions decide when automation acts. Neither replaces the other.

## What's next

> **[Approval risk limits](https://docs.coderabbit.ai/pr-reviews/approval-risk-limits.md)**
>
> Set merge and security risk limits, with overrides for teams and paths.

> **[Triage rules](https://docs.coderabbit.ai/triage/rules.md)**
>
> Merge, close, or fix pull requests automatically when they match conditions you choose.

> **[Automatic Approvals](https://docs.coderabbit.ai/pr-reviews/automatic-approvals.md)**
>
> See exactly when CodeRabbit requests changes and when it approves.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.