Why are fine-grained GitHub App installation permissions preferred over a single classic PAT with broad repo scope for organization automation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub Apps win on least privilege, install scope, and auditability. They aren't a free pass on rate limits or branch protection.
Full explanation below image
Full Explanation
GitHub Apps support installation on selected repositories with granular permission sets and short-lived installation tokens, which is superior to a classic personal access token carrying broad repo scope tied to a human identity. That reduces blast radius, clarifies ownership, and improves revocation. Apps are still rate limited. Classic PATs are not inherently more compliant; long-lived broad PATs are a frequent audit finding. Apps do not inherently bypass branch protection or rulesets. Administrators should inventory automation identities, migrate high-risk classic PATs, and require owners to justify each App permission during reviews.