Skip to main content
| Risk limits make Automatic Approvals depend on how risky a pull request is. When a pull request’s risk is above the limit you set, CodeRabbit withholds its approval, and the pull request needs approval from people instead. Routine pull requests within the limit still get CodeRabbit’s approval once the other approval requirements are met. CodeRabbit assigns the risk level during its review. You choose only the highest level at which CodeRabbit may still approve. Without a limit, CodeRabbit approves at any risk level, including Critical, once the other requirements are met.

​
Choose what to limit

You can limit two assessments. Most teams need only the merge risk limit. Both use the same levels, from lowest to highest: minimal, low, moderate, high, and critical. A limit includes its own level: with max_merge_risk: low, CodeRabbit can approve at Minimal or Low Merge Risk and withholds approval at Moderate or above. If you set both limits, a pull request must be within both.

​
Set a merge risk limit

Add max_merge_risk next to enabled in .coderabbit.yaml:
.coderabbit.yaml
CodeRabbit compares the limit with the Merge Risk shown in its summary comment for the current commit. To pick a level, compare it with the Merge Risk levels. Moderate means the review left a material issue that should be resolved before merging, so max_merge_risk: low sends those pull requests to people and lets CodeRabbit approve the rest.

​
Set a security risk limit

max_security_risk limits the security architecture risk from a Security Architecture Review.
A security risk limit needs a Security Architecture Review of the current commit. CodeRabbit runs that review only with CodeRabbit Security, which is included in the Advanced and Enterprise plans, and only on pull requests with enough security-relevant architecture changes. On every other pull request, the assessment is unavailable, so CodeRabbit withholds its approval. Without CodeRabbit Security, a security risk limit stops CodeRabbit from approving any pull request.
Set this limit only if CodeRabbit should approve just the pull requests whose Security Architecture Review is within the limit:
.coderabbit.yaml
Security architecture risk is separate from the severity of individual Security findings. To block merging on Security findings above a severity, use the CodeRabbit Security check instead.

​
Set different limits for teams

Use overrides to give pull requests from particular GitHub teams a different limit. An override can be wider or stricter than the global limit:
.coderabbit.yaml
In this example, CodeRabbit can approve pull requests from members of acme/platform-leads or acme/sre up to Moderate Merge Risk, and pull requests from acme/contractors only at Minimal. Everyone else keeps the global Low limit. How CodeRabbit applies overrides:
  • An entry applies when the pull request author belongs to any team in its teams list. Who requests the review, posts a command, or merges the pull request makes no difference.
  • Write each team as organization/team-slug. Team names are not case-sensitive.
  • Each entry must set at least one limit or disable approvals with enabled: false. A limit that an entry leaves out keeps the global value.
  • If the author matches several entries that set the same limit, the strictest value applies. In the example, an author in both acme/sre and acme/contractors gets minimal. The order of entries does not matter.
  • All entries together can list up to 15 different teams.
CodeRabbit reads team membership through its GitHub App, which has read access to organization members. On GitHub Enterprise Server, give the app the Members read-only permission. Every listed team must exist and be visible to the app. If a team is missing or hidden from the app, or the membership lookup fails, CodeRabbit cannot tell which limit applies to the author, so it withholds approval and says so in its notice. Check the team names and the app’s access to those teams, then let CodeRabbit review the pull request again. Team matching works only with GitHub teams. On other Git providers, CodeRabbit withholds approval if an applicable override requires team membership.

​
Set different limits for paths

Use paths when a part of your codebase needs more careful review. You can apply a limit to everyone who changes those files, or combine paths with teams to narrow it to particular authors:
.coderabbit.yaml
The first override limits any pull request touching packages/auth/ to Low Merge Risk. The second applies the same limit when an author from either listed team changes services/payments/ or infra/. Changes elsewhere keep the global Moderate limit unless another override matches.
  • With teams alone, the override applies to those authors wherever they work. With paths alone, it applies to anyone changing those files. With both, the author and the changed paths must match.
  • Paths are relative to the repository root and use the same glob syntax as path filters. For example, ["services/**", "!services/docs/**"] excludes the documentation directory. Matches are case-insensitive and include hidden files.
  • One matching file is enough to apply the limits to the whole pull request. CodeRabbit checks the full changed-file list, including deleted files and both the old and new paths of renamed files. Files excluded from review still count for these overrides.
  • Each entry needs teams, paths, or both, plus at least one risk limit or enabled: false. Omit a selector to leave it unrestricted; do not use an empty list.
  • When several entries match, the strictest explicitly set value wins for each limit. A limit left out of every matching entry keeps the global value.

​
Require human approval for teams or paths

Set enabled: false in an override to keep matching pull requests for human approval, whatever their risk scores:
.coderabbit.yaml
CodeRabbit won’t approve any pull request that touches infra/production/. It also won’t approve a pull request from a member of acme/contractors that touches services/payments/. For the second override, both the team and path must match. One matching disabled override is enough to withhold approval for the whole pull request, even if another matching override allows its risk scores. Order does not matter. CodeRabbit still reviews the changes, posts comments, and requests changes for unresolved findings. The approve and resolve commands cannot bypass the override. In the web interface, open All settings → Automatic approvals → Overrides and select Disabled under Automatic approvals for the entry. Use global setting removes the disable setting. An override cannot turn on a globally disabled workflow; omit enabled to keep the global behavior. To make human approval a merge requirement, also configure your Git provider’s required reviews. Withholding CodeRabbit’s approval alone does not block merging. If CodeRabbit cannot verify the complete changed-file list for the current commit, it withholds approval rather than assuming no path matches. Path-only overrides do not require GitHub team access; they require a Git provider that can supply a complete changed-file list.

​
See which limits applied

When CodeRabbit evaluates the approval policy, expand Recent review info in its summary comment, then Automatic approval policy. The section lists the matching overrides and shows whether approvals are enabled, along with the effective merge and security limits and the override that supplied each setting. When an override disables approval, the section names it. If no override matched, it shows the global settings. If CodeRabbit could not verify the paths or teams, it explains that instead of choosing an override. Override numbers refer to their positions in the resolved configuration. Use @coderabbitai configuration to inspect that configuration and where its values came from. The policy section names the assessed commit and appears for both approvals and withheld approvals when review info is enabled.

​
Where limits come from

Limits follow configuration inheritance. A limit you leave out of a repository configuration takes the value from the organization or central configuration, if one sets it. A limit is unrestricted only when no configuration source sets it. Override entries from inherited configurations count too when CodeRabbit combines matching entries. Configuration overrides in a pull request or review description cannot change automatic approval settings. In the web interface, Not set removes a limit from the configuration you are editing. An inherited limit can still apply.

​
When CodeRabbit withholds approval

CodeRabbit withholds its approval when:
  • A matching override sets enabled: false.
  • An assessment is above its limit.
  • An assessment that a limit needs is unavailable for the current commit: it is missing, it failed, or it describes an earlier commit. CodeRabbit never treats a missing assessment as low risk. See when Merge Risk is unavailable.
  • An applicable override needs team membership that CodeRabbit cannot verify, or a path override needs a complete changed-file list that is unavailable.
When it withholds approval, CodeRabbit:
  1. Posts a review titled Automatic approval withheld that neither approves nor requests changes. It explains the policy that withheld approval, suggests a Next step, and names the assessed commit. When risk limits apply, it also lists the assessments and limits.
  2. Adds the same notice to its summary comment.
  3. Dismisses its own earlier approval of the pull request. It also dismisses its earlier request-changes review if the review threads are resolved and no Pre-Merge Check is still blocking. If CodeRabbit cannot dismiss a review, the notice says so and a maintainer must dismiss it in the Git provider.
Risk alone never makes CodeRabbit request changes. A pull request whose findings are resolved but whose risk is above the limit ends up with neither an approval nor a request for changes from CodeRabbit. To move the pull request forward, have a maintainer review the remaining risk and approve it in your Git provider, or change the code and let CodeRabbit review the new commit. The approve and resolve commands do not bypass risk limits.

​
Risk limits and Triage

Risk limits decide only whether CodeRabbit approves. To have CodeRabbit merge some pull requests automatically, use Triage rules; Choose an approval policy shows how the two fit together.

​
What’s next

Merge Risk

Learn what each Merge Risk level means and where CodeRabbit shows it.

Choose an approval policy

Decide which pull requests need human approval and configure GitHub to match.