Your organization defines three agent autonomy tiers: Tier 1 (read-only exploration), Tier 2 (can propose changes via PR), Tier 3 (can merge approved PRs). Which GitHub Actions workflow permissions mapping is correct for this tiered model?

The correct permission mapping follows least-privilege at each tier:

Tier 1 (read-only exploration): contents:read only. The agent can read repository files, check history, and generate insights. It cannot write any files or create any resources. This is the lowest risk tier — even if the agent malfunctions, it cannot cause any changes.

Tier 2 (propose changes via PR): contents:write (to push to a feature branch) and pull-requests:write (to open a PR). The agent can create code changes but cannot approve or merge them. Human reviewers must approve the PR.

Tier 3 (merge approved PRs): Same as Tier 2 (contents:write, pull-requests:write) but with environment protection rules configured on the target branch. The agent's merge action requires an environment approval gate (e.g., a required reviewer approval of the environment deployment). This prevents the agent from auto-merging without human sign-off, even though it has write access.

The mapping that gives Tier 1 contents:write, gives Tier 2 contents:read with pull-requests:write, and gives Tier 3 contents:write and pull-requests:write is wrong because Tier 1 write access violates read-only, Tier 2 cannot push proposed changes with only read access to contents, and Tier 3 lacks the protected merge gate required for autonomous merging.

The mapping that gives Tier 1 no permissions and gives Tiers 2 and 3 admin is incorrectly extreme in both directions: Tier 1 needs at minimum contents:read to function, and admin for Tiers 2 and 3 grants far more access than needed.

The mapping that gives all tiers the same permissions but controls them with rate limits on API calls does not enforce tier boundaries — rate limits control frequency, not action type.