When a member creates a fine-grained personal access token that targets organization resources, what enterprise/organization control commonly applies before the token can access those resources?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fine-grained PATs are scoped — good — but when they touch org resources, many enterprises force an approval step so owners see who wants what access. That is a big improvement over classic PATs with a giant repo scope living forever in someone's shell history. Teach developers to request least privilege and expire tokens aggressively.
Full explanation below image
Full Explanation
The correct answer is that organization owners may be required to approve fine-grained PAT access to organization resources when approval policies are enabled. Fine-grained PATs support repository-level and permission-level scoping and can be governed with enterprise/organization policies, including approval workflows for org-owned resources. Option A is wrong: PATs do not elevate users to enterprise owner. Option C is wrong: fine-grained tokens can request write permissions and are not inherently always read-only. Option D is wrong: members (not only outside collaborators) create PATs subject to policy. Administrators should prefer fine-grained over classic PATs, set maximum lifetimes, monitor token use in audit logs, and revoke promptly on offboarding.