# Safety categories

> The nine safety categories, the action each preset gives them, and what always waits for you.

The preset is `safety.preset` in your config. `safety.rules` overrides single categories, and `safety.everyMerge` sets the floor for every merge. [What waits for you](/docs/what-waits.md) explains how they fit together. To see how one ticket would be treated:

```sh
dobby safety explain "Add Stripe refunds to the orders page"
```

## Actions

| Action | What happens |
| --- | --- |
| `auto` | Normal review, then merge. |
| `review` | A strict review on the strongest model, then merge. |
| `owner` | Dobby opens a draft pull request and reviews it, and you merge it with `dobby merge <id>` or the Merge button on the dashboard. |
| `never` | Agents do not take the ticket. |

## Presets

| Category | Strict | Balanced | Autonomous |
| --- | --- | --- | --- |
| `migrations.schema` | `owner` | `auto` | `auto` |
| `migrations.data` | `owner` | `owner` | `review` |
| `payments` | `owner` | `review` | `review` |
| `auth` | `owner` | `review` | `review` |
| `secrets` | `owner` | `review` | `review` |
| `deploys` | `owner` | `auto` | `auto` |
| `config` | `owner` | `auto` | `auto` |
| `client-sites` | `owner` | `owner` | `review` |
| `releases` | `owner` | `owner` | `review` |
| Every other merge | `owner` | `auto` | `auto` |

The last row is the floor that `safety.everyMerge` replaces. A change in several categories gets the strictest action among them.

## Categories

| Category | Covers |
| --- | --- |
| `migrations.schema` | A migration file that only changes the shape of the database, such as a new table, column or index. |
| `migrations.data` | A migration file that changes existing data: it updates, inserts or deletes rows, drops or renames a table or column, or changes a column type. A migration whose SQL Dobby cannot read counts here too. |
| `payments` | Code that handles real money: charging, billing, refunds, payouts, subscriptions or a payment provider. |
| `auth` | How people sign in: sessions, passwords, tokens, permissions or access control. |
| `secrets` | Secrets, tokens, API keys, passwords or credentials, or a change to a `.env` or `secrets` file. |
| `deploys` | Deploys and CI: a ticket about a deploy, production or a pipeline, or a change to `wrangler.toml`, `.github/workflows/` or a Dockerfile. |
| `config` | Config files such as `wrangler.toml`, `eas.json`, `app.json` or `*.config.*`, or a ticket about config. |
| `client-sites` | A paying client's own site or data, in a project you list under `clientProjects`. |
| `releases` | A release to users: an app store or Play Console release, a version publish, or a change to `eas.json` or `fastlane/`. |

Migrations are sorted by the SQL in the changed files. Payments, auth, client sites and releases go through a word and path check first, then the classifier set in `safety.classifier` decides.

## What always waits

These wait for you whatever the preset and the rules say:

- Running a migration that changes existing data. The deploy that would run it waits for its own tap.
- A ticket an agent filed from outside input, such as an email or a Claude MCP call.
- The first merge on a fresh install. `dobby init` pauses merges until you run `dobby resume merges`.