An operations lead is automating weekly release notes that must read closed issues, summarize changes, and open a draft pull request with the notes file, but it must never delete repositories or manage access. Which tool selection should the lead configure within the automation to balance capability and safety?

The selection that grants read access to issues and write access to pull requests and contents follows least privilege while enabling the full workflow: reading issues supports summarizing closed work, write access to contents lets the automation create or update the notes file, and write access to pull requests lets it open a draft. It grants no administration access, avoiding permissions for repository deletion or access management. Granting read access to issues, contents, and pull requests but write access only to contents would allow issue review and file changes, but not opening a draft, because reading pull request data does not grant creation rights. Granting read access to issues and contents with write access to pull requests would support issue review and draft creation, but not saving the notes file, since write access to pull requests does not confer write access to contents. Adding write access to administration settings along with write access to pull requests and contents would enable the workflow, but exceeds the stated need and violates the safety constraint by allowing repository and access administration. An exam caveat is that issues, pull requests, contents, and administration are distinct permission areas; write access to one does not imply write access to another. As a practical check, test the automation in a test repository: confirm it can summarize closed issues, save the notes file, and open a draft, while an administration change is denied.