> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Permission Pyramid

> Guide to designing least-privilege GitHub governance by mapping administrative and repository roles to assign precise permissions and reduce blast radius

Robust governance depends on clearly separating high-level platform configuration from day-to-day development responsibilities. This article maps specialized administrative roles (for example, billing managers and moderators) alongside the five standard repository permission roles so you can design a secure, least-privilege governance model.

![A slide titled "Robust Governance" with two side-by-side boxes. The left box says "Platform configuration — High-level" with a shield icon, and the right box says "Development tasks — Everyday" with code brackets.](https://mintcdn.com/kodekloud-c4ac6d9a/Ae2SeWV4btujbkSt/images/GitHub-Administration-Certification/Governance-and-Roles/The-Permission-Pyramid/robust-governance-platform-configuration-development-tasks.jpg?fit=max\&auto=format\&n=Ae2SeWV4btujbkSt\&q=85\&s=80cdb3848065fa6fc4cf13abbbc38fde)

The pattern is simple: start at the top with enterprise- and organization-level responsibilities, then descend to repository-level roles. This makes it easier to assign the right people the right privileges and minimize blast radius when something goes wrong.

Administrative roles

Enterprise-level roles

* Enterprise owner
  * Full control over the enterprise account and all organizations beneath it.
  * Can perform organization-wide configuration, access control, and administrative tasks.
* Enterprise billing manager
  * Scoped to finance: can manage payment methods and view invoices.
  * Cannot access repository code or change repository settings.

Organization-level roles

* Organization owner
  * Full control of the organization, including repositories, teams, and organization settings.
  * Can add or remove owners and change organization-wide policies.
* Organization billing manager
  * Manages the organization’s billing and invoices without access to repository source code or settings.
* Organization moderator
  * A highly specialized, non-administrative role focused on community health.
  * Duties include hiding disruptive comments, locking heated threads, and blocking abusive users.
  * Does not receive repository or organization administration privileges.

![A presentation slide titled "The Organization Moderator" describing a highly specialized role focused on community health. It lists duties like hiding disruptive comments and locking heated threads, and notes administrative power is not included.](https://mintcdn.com/kodekloud-c4ac6d9a/Ae2SeWV4btujbkSt/images/GitHub-Administration-Certification/Governance-and-Roles/The-Permission-Pyramid/organization-moderator-community-health-no-admin.jpg?fit=max\&auto=format\&n=Ae2SeWV4btujbkSt\&q=85\&s=d6170fcf10c1743fc961cef17ba81ebb)

Quick reference — administrative roles

| Role type | Typical role examples | Primary responsibilities | Limited or excluded capabilities |
| - | - | - | - |
| Enterprise | `Enterprise owner`, `Enterprise billing manager` | Manage enterprise settings, organization creation, and billing | Billing managers cannot access repositories |
| Organization | `Organization owner`, `Organization billing manager`, `Organization moderator` | Manage org settings, teams, billing, and community moderation | Moderators and billing managers cannot change repo settings or view code |

Repository roles — the ladder of trust

At the repository level, GitHub provides five standard permission roles. Treat these as progressively more trusted rungs, from least to most powerful.

1. Read
   * Can view and clone the repository and participate in conversations (issues and pull requests).
   * Cannot modify issue/PR metadata beyond participating in discussions or push code.

2. Triage
   * Can organize the project: apply labels, assign issues, open/close issues, and manage issue and PR metadata.
   * Cannot push commits or create branches.

3. Write
   * The standard developer role: can push commits, create branches, and open/submit pull requests.
   * Can review and participate in the code workflow, but cannot change higher-level repository settings.

4. Maintain
   * Intended for technical leads and release managers: can merge PRs, manage releases, and maintain many repository settings and workflows.
   * Performs day-to-day operational tasks but cannot always perform destructive or organization-wide admin actions (for example, transfer or delete organization resources in some contexts).

5. Admin
   * Full control over the repository: change branch protection rules, modify settings, transfer or delete the repository, and manage access for other users.

Repository roles — summary table

| Role | Can view code | Can push code | Manage issues/PR metadata | Manage releases / settings | Can delete/transfer repo |
| - | -: | -: | -: | -: | -: |
| Read | Yes | No | Participate only | No | No |
| Triage | Yes | No | Yes (labels, assignments) | No | No |
| Write | Yes | Yes | Yes | Limited | No |
| Maintain | Yes | Yes | Yes | Yes (releases, many settings) | Limited |
| Admin | Yes | Yes | Yes | Yes (full) | Yes |

Key distinctions to remember:

* Billing managers (enterprise or organization) can manage billing and view invoices but do not have access to repository code.
* A team maintainer manages team membership and team-level settings; a repository maintainer (role: Maintain) manages repository operations like merging and releases.
* `Triage` is the highest repository role that cannot push code; `Write` is the role that grants push access.

Governance checklist (practical tips)

* Use organization-level owners sparingly and prefer team-based admin delegation for routine tasks.
* Assign billing manager roles to a dedicated finance account, not to developer accounts.
* Use `Triage` for community managers and moderators who should manage issues without write access.
* Reserve `Admin` for a small group of trusted operators and use audit logs to monitor admin actions.

Links and references

* [GitHub Docs — Repository permission levels](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/repository-permission-levels)
* [GitHub Docs — Moderation tools](https://docs.github.com/en/site-policy/content-moderation)
* [Kubernetes Documentation — concepts reference (example governance patterns)](https://kubernetes.io/docs/concepts/)

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/e4b7bd78-3fb5-4c1c-94d8-e528b0b60484/lesson/16377d05-5995-4d62-af21-e02c97423ff4)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.