Enabling developers
The mandatory, fail-closed allowlist that decides whose PRs get reviewed.
ReviewIQ reviews a pull request only when its author is enabled on the Developers page. This is not optional and it is fail-closed: if the author cannot be resolved, the PR is not reviewed.
Why the author, not the actor
The gate always keys on the person who opened the pull request — never on whoever triggered the event. An enabled teammate commenting /review on a disabled author's PR does not bypass the gate. Nor does the disabled author commenting on their own.
Populating the roster
Use Sync collaborators to discover users up front: GitHub and GitLab enumerate each active repo's collaborators, Bitbucket Cloud lists workspace members. Bitbucket Data Center and Azure discover users lazily as they open pull requests. Enabling a developer never gets overwritten by a later sync.
Every path is gated
Automatic reviews on open/update, comment commands, dashboard-triggered reviews, and PR chat all pass through the same check. An admin can force a one-off review from the dashboard with an explicit override.