# Manage repository access

Repository admins decide who can work on a repository under
**Settings → Access**. Organization members also get the organization's
[default repository permission](https://staging.git.cafe/docs/organizations/organization-settings.md).

## Roles

Roles are cumulative; each includes everything the one before it can do.

- **Reader**: read the code, issues and pull requests, open issues and comment.
- **Triager**: also triage issues and pull requests: labels, assignees,
  milestones, pinning and locking.
- **Writer**: also push branches and merge pull requests.
- **Maintainer**: also open the repository's **Settings**.
- **Admin**: also manage access, [rulesets](https://staging.git.cafe/docs/repositories/repository-rulesets.md),
  visibility, transfer and deletion.

## Add a collaborator

1. Choose **Add collaborator**.
2. Search for the user by handle (at least two characters) and pick them.
3. Choose a role and confirm.

Change a collaborator's role from the menu in their row, or remove them with
the bin icon. From the terminal:

```sh
cafe repo collaborator add alice --role repo-writer
cafe repo collaborator remove alice
```

The CLI can grant `repo-reader`, `repo-triager` or `repo-writer`; use the
browser for higher roles.

## Give a team access

Repositories owned by an organization also have a **Teams** table listing every
team in the organization with its role on this repository, or **No access**.
Pick a role to grant access, change it in place, or use the bin icon to revoke
it. See [teams](https://staging.git.cafe/docs/organizations/teams.md).