What is a security benefit of enterprise policies that restrict or disable classic personal access tokens in favor of fine-grained PATs?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Classic PATs are the old sledgehammer: wide scopes, hard to reason about. Pushing the enterprise toward fine-grained PATs (or better, GitHub Apps) shrinks blast radius when a token leaks. Pair that with SSO authorization requirements, short lifetimes, and audit — passwords in CI are a step backward, not forward.
Full explanation below image
Full Explanation
The correct answer is that administrators reduce broad, coarse-scoped tokens in favor of resource-scoped credentials. Classic PATs often use wide scopes such as full repo access, which increases impact if leaked. Enterprise policy can restrict classic PATs and steer users toward fine-grained PATs with least-privilege permissions and clearer resource binding. Option A is the opposite of good policy. Option B is incorrect and undesirable; SAML SSO authorization requirements still matter for token use against SSO-protected orgs. Option D is wrong: passwords are not the recommended CI auth path. Combine PAT policies with secret scanning, short expirations, and migration of critical automation to GitHub Apps.