LEARN. PRACTICE. GROW.Concept and mechanism
Choose permissions by required actions rather than job title. Read supports inspection and limited participation; Triage supports issue management and applying existing labels without granting push or merge; Write adds code contribution. Maintain and Admin have different capabilities and should not be assigned merely to resolve a triage request. Identity also needs recovery: keeping 2FA codes only on the factor device retains a single point of loss. Use supported methods and independent secure storage. Enterprise Managed Users provides accounts provisioned and managed through the identity provider. It is not equivalent to assuming SSO automatically converts personal accounts into managed ones.
Guided application
In a fictional payments setting, check repository audience before storing restricted documentation. Internal visibility in an enterprise permits reading across its organizations; it does not mean only the owning team. For restricted material, choose private scope and suitable permissions, considering administrators who retain access. For integration rules, distinguish classic branch protection from rulesets. Administrator bypass can explain an unreviewed merge under classic protection defaults. Do not present that exception as evidence of satisfied controls. Test permitted and denied access using representative identities and record the approved emergency-change procedure.
Triage for issue management; protection with reviewed bypass for merge control; neither action replaces the other.
Common pitfalls
Job title as Admin; 2FA without recovery; internal as team-only; SSO as EMU; bypass as approval.
Related topics: Git, local state, and collaboration · Repositories, guidance files, and maintenance · Conversations, traceability, and sharing
Confirm identity, audience, operations, and exceptions as separate access concerns.
Reference: Repository roles · GH-900 skills measured January2026;study guide updated2026-02-19