What is a security benefit of enterprise policies that restrict or disable classic personal access tokens in favor of fine-grained PATs?
Select an answer to reveal the explanation.
Short Explanation
Classic PATs are the old sledgehammer: wide scopes, hard to reason about. When you push the enterprise toward fine-grained PATs, you shrink the blast radius if a token leaks. Pair that with SSO authorization, short lifetimes, and audit; don't go backward to passwords in CI.
Full Explanation
The correct answer is that administrators reduce broad, coarse-scoped tokens in favor of resource-scoped credentials. Classic PATs often use wide scopes such as full repo access, which increases impact if leaked. Enterprise policy can restrict classic PATs and steer users toward fine-grained PATs with least-privilege permissions and clearer resource binding. The claim that classic PATs become unlimited in lifetime automatically is the opposite of good policy. The claim that classic PATs gain the ability to bypass SAML entirely without SSO authorization is incorrect and undesirable; SAML SSO authorization requirements still matter for token use against SSO-protected orgs. The claim that all CI systems must switch to password authentication over HTTPS is wrong: passwords are not the recommended CI auth path. Combine PAT policies with secret scanning, short expirations, and migration of critical automation to GitHub Apps.