An agent normally operates with read-only GitHub access to browse repositories and issues. Occasionally, it needs to create a branch and push a commit as part of a specific workflow. Which permission design MOST securely handles this elevated-privilege operation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Permanent write access for occasional write operations is like giving a contractor a master key because they need to enter one specific room once. Scoped, time-limited tokens are the 'temporary visitor badge for room 3B only, valid for 2 hours' of the agent world. A GitHub App installation token can be scoped to a single repository and a short TTL — so even if the token is intercepted, the blast radius is bounded in both scope and time.
Full explanation below image
Full Explanation
Principle of least privilege in agent systems means not just limiting what an agent can access, but also limiting when it can access it and for how long. Permanent elevated permissions create persistent attack surface; temporary scoped permissions minimize it.
Option A (permanent write access) violates least privilege directly. If the agent is compromised, an attacker has persistent write access to all repositories. If the agent has a logic bug that causes unintended writes, the damage is unconstrained. The operational benefit (simpler token management) does not justify the security cost of permanent broad access.
Option B is correct and implements just-in-time permission escalation using GitHub App installation tokens: (1) The agent's base credentials are read-only — this is its permanent posture. (2) When a write workflow is triggered, the agent requests a GitHub App installation token scoped to the specific repository and the specific permissions needed (contents:write for the branch push). (3) The token is short-lived (GitHub App installation tokens expire in 1 hour by default, and can be configured shorter). (4) After the operation completes, the token is not stored; it is allowed to expire. This design means the agent's elevated permissions exist only during the window needed, scoped only to the repository needed, with an automatic expiry that limits exposure from any interception.
Option C (full-scope PAT in secrets) is a common but insecure pattern. A PAT with full repo scope has broad, long-lived permissions. It cannot be scoped to a single repository or a single operation. If the secret is extracted from GitHub Actions (via log injection, artifact exposure, or fork PR attacks), the attacker has long-lived write access to all repos the token owner can access.
Option D (human performs write manually) defeats the automation purpose for rare but automatable operations. It creates an asymmetric system where the agent handles 95% of the workflow but humans handle the critical write operation — combining the cost of automation (agent maintenance) with the cost of manual processes (human bottleneck).