Permission Change Checker

Stop access changes that were never approved.

Mo flags pull requests that break approved permission rules. Role access, exports, admin actions, guest visibility, and sensitive screens — caught before merge.

See 10s demo Start free trial

Works with Slack, GitHub, and GitLab.

Alex
Only admins can export users. Product lead confirmed.

Maya
@Mo approve this

Mo
Approved

"Only admins can export users."

Pull request #248

mo-bot bot
Conflicts with approved permission rule

Approved: Only admins can export users

PR opens: export access to all users

CONFLICT WITH APPROVED RULE

Permission drift is easy to miss and expensive to fix.

  • A guest user suddenly sees billing.
  • An export endpoint becomes available to the wrong role.
  • An admin-only action loses its restriction.
  • A support user gains access to internal settings.

These changes can slip through review because the code still works. The risk is in who can now do what.

Mo catches pull requests that break approved permission rules before they merge.

Common permission changes teams want to catch

  1. Role-based access
    Keep admin, manager, member, guest, and internal roles aligned with approved access rules.

  2. Exports and downloads
    Flag when CSV exports, reports, or sensitive downloads are opened to the wrong users.

  3. Billing and account settings
    Catch changes that expose billing data, payment actions, or account controls to unauthorized roles.

  4. Internal tools and ops screens
    Protect support, ops, and internal-only interfaces from accidental exposure.

  5. Sensitive actions
    Catch changes to delete actions, approval flows, and privileged operations that should stay restricted.

What this protects against

What usually happens

  • A reviewer checks the code.
  • The logic compiles.
  • Tests pass.
  • Nobody notices the access rule changed.

What Mo adds
Mo checks the pull request against approved permission rules. If access is wider than approved, the pull request is flagged before merge.

Examples of approved permission rules

  • Only admins can export users
  • Guest users cannot access billing settings
  • Support users can view accounts but cannot delete them
  • Only finance can issue refunds
  • Internal notes are visible only to staff
  • Members cannot change organization-wide settings
  • Only account owners can cancel subscriptions
  • Audit logs are never visible to guests
  • API keys can only be created by admins

Why this matters now

As teams ship faster, permission changes can be buried inside ordinary feature work. A single pull request can quietly widen access in ways nobody intended. Mo adds a focused check for one of the easiest mistakes to miss and one of the worst to discover late.

How it works

Step 01
Approve a permission rule in Slack
Use Slack to approve a rule like "Only admins can export users" or "Guest users cannot access billing settings."

Step 02
Mo watches pull requests
Mo watches pull requests in GitHub or GitLab automatically after connecting.

Step 03
Flag risky access changes
If the code breaks the approved rule, Mo flags it before merge. Teams can also upload documents with permission rules and approve what should be enforced.

For teams handling sensitive product areas

  • B2B SaaS
    Protect admin controls, exports, and account-level settings. Keep role-based access rules intact across feature work and refactors.

  • Marketplaces & ops tools
    Protect internal tools, staff actions, and restricted flows. Prevent accidental exposure of ops dashboards, admin views, or privileged actions.

  • Compliance-sensitive products
    Protect access to customer data, finance actions, and restricted functionality. Enforce the access boundaries your compliance or legal team requires before any PR merges.

FAQ

Can Mo catch every permission bug?
Mo is built to flag pull requests that violate approved permission rules. It adds an explicit check before merge.

Do rules need to be written by developers?
No. Product, ops, or engineering leads can approve permission rules in Slack.

Is this just for admin roles?
No. Teams use Mo for guests, members, managers, support users, finance roles, and internal access rules.

Catch access drift before it becomes a problem.

Approve permission rules in Slack. Let Mo flag risky pull requests before merge.

Start free trial See 10s demo