Why should enterprise administrators set the default GITHUB_TOKEN workflow permissions to read-only at the organization or enterprise level?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Default read for GITHUB_TOKEN is least privilege—workflows only get write when they explicitly opt in. This does not disable self-hosted runners or stretch job timeouts automatically.
Full explanation below image
Full Explanation
Organization and enterprise policies can set the default permissions granted to the GITHUB_TOKEN for workflows. A read-only default means jobs start with minimal rights and must declare broader permissions only when required, shrinking the impact of a compromised or malicious workflow. This does not disable self-hosted runners, change job timeout maximums, or relocate workflows into reusable workflow repositories. Administrators should combine default permissions with environment protection rules, OIDC for cloud access, and approved Actions allow lists. Teams need guidance on when elevating permissions is justified so developers do not cargo-cult write-all blocks.