An agent normally operates with read-only GitHub access to browse repositories and issues. Occasionally, it needs to create a branch and push a commit as part of a specific workflow. Which permission design MOST securely handles this elevated-privilege operation?
Select an answer to reveal the explanation.
Short Explanation
You shouldn't give an agent permanent write access just because it occasionally needs to push a commit. Use a scoped GitHub application installation token that's requested for the write workflow, limited to the one repository, and expires or gets revoked right after the push. That keeps the blast radius small if the token leaks.
Full Explanation
Principle of least privilege in agent systems means not just limiting what an agent can access, but also limiting when it can access it and for how long. Permanent elevated permissions create persistent attack surface; temporary scoped permissions minimize it. The permanent write access design violates least privilege directly. If the agent is compromised, an attacker has persistent write access to all repositories. If the agent has a logic bug that causes unintended writes, the damage is unconstrained. The operational benefit, simpler token management, does not justify the security cost of permanent broad access. The scoped GitHub application installation token design is correct and implements just-in-time permission escalation: the agent's base credentials are read-only, which is its permanent posture. When a write workflow is triggered, the agent requests a GitHub application installation token scoped to the specific repository and the specific permissions needed, such as contents:write for the branch push. The token is short-lived; GitHub application installation tokens expire in 1 hour by default, and can be configured shorter. After the operation completes, the token is not stored; it is allowed to expire, or it can be revoked immediately after the branch is pushed. This design means the agent's elevated permissions exist only during the window needed, scoped only to the repository needed, with an automatic expiry that limits exposure from any interception. The personal access token design is a common but insecure pattern. A personal access token with full repository scope has broad, long-lived permissions. It cannot be scoped to a single repository or a single operation. If the secret is extracted from GitHub Actions, via log injection, artifact exposure, or fork pull request attacks, the attacker has long-lived write access to all repositories the token owner can access. The human-performs-the-write design defeats the automation purpose for rare but automatable operations. It creates an asymmetric system where the agent handles most of the workflow but humans handle the critical write operation, combining the cost of automation, agent maintenance, with the cost of manual processes, human bottleneck.