# Access and permissions

> What devlo can access, who can trigger it, and how to remove its access.

You choose which repositories the devlo GitHub App can access when you install it. GitHub, Google, Jira, and Slack each show the permissions devlo requests before you approve them.

## What devlo does

As `devloai[bot]`, devlo comments, reviews pull requests, and creates branches, commits, and pull requests. The PR Assistant and automations can also manage issues, pull requests, and labels, as their [capabilities](/automations/) allow. devlo approves a pull request only if **Approve pull requests** is on for the repository (off by default).

## Who can trigger devlo

| Trigger                           | Who                                                                                                   |
| --------------------------------- | ----------------------------------------------------------------------------------------------------- |
| Code review on a new pull request | Any non-bot pull request author                                                                       |
| `/review`                         | Anyone who can comment on the pull request                                                            |
| `@devloai`                        | Anyone with write access to the repository                                                            |
| Quick fix links                   | The pull request author only                                                                          |
| Repository chats                  | Owners and admins, and members with write access to the repository                                    |
| Jira                              | Anyone who can mention the app on the linked site                                                     |
| Slack                             | Members of the connected workspace, but not people from other organizations in Slack Connect channels |
| Automations                       | Anyone who causes the event. Comment triggers need write access.                                      |

Removing a member stops them on GitHub, but not in Jira or Slack.

Caution

On a public repository, anyone on GitHub can open a pull request or issue, or comment `/review`, and the runs use your organization’s credits. Add filters to the triggers to limit this.

## Remove devlo’s access

* **Repositories or the whole app:** change the installation on GitHub. See [Change repositories](/get-started/connect-github/#change-repositories).
* **Jira or Slack:** an owner or admin disconnects it in **Settings > Integrations**, then removes the app from the Jira site or Slack workspace. See [Jira](/coding/jira/#limits-and-disconnecting) or [Slack](/coding/slack/#limits-and-disconnecting).
* **A person:** an owner or admin removes them in **Settings > User Management**. See [Organizations and members](/account/members/#change-roles-and-remove-members).