Why do many enterprises set the default GITHUB_TOKEN workflow permissions to read-only at the organization or enterprise level?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Default read for GITHUB_TOKEN is least privilege for CI: a random workflow cannot push or rewrite releases unless someone explicitly opts into write permissions. That shrinks damage from poisoned dependencies or bad PRs. It does not replace branch protection and is unrelated to interactive human login tokens.
Full explanation below image
Full Explanation
The correct answer is reducing blast radius by requiring explicit write permissions. Organizations can set default token permissions to read and let individual workflows request contents: write only when needed. Option A is not the goal; well-written workflows still succeed. Option C is false. Option D confuses workflow tokens with user auth. Pair with forbidden fork write patterns, environment gates, and actions allow lists.