You are a product lead at a 60-person education startup with an organization Project that consolidates roadmap tasks from private curriculum repositories. Full-time staff must edit and prioritize items, while part-time mentors need progress visibility without editing rights or broad repository access. Which access configuration should you apply to control GitHub Projects access?

The correct configuration keeps the Project private while using collaborator roles to separate editing from viewing, so full-time staff retain edit and prioritize capability and part-time mentors receive live read-only visibility without gaining broad access to private curriculum repositories, which fits the GitHub model where Project permissions are independent of repository permissions and consolidation does not require repository membership. The repository-based viewing approach fails on least privilege because granting mentors direct read to linked curriculum repositories for transparency violates the explicit constraint against broad repository access and exposes sensitive curriculum content beyond the roadmap. The internal visibility approach fails on confidentiality scope because opening the consolidated Project across the organization for convenient viewing violates the private requirement and risks leaking aggregated private-repository information to members who should not see it. The export-based update approach fails on live access because retaining a staff-only Project and sending automated summaries preserves editing control and confidentiality but denies mentors the requested in-Project progress visibility and creates stale data with extra maintenance. Exam caveat is to separate Project visibility, collaborator role, and repository access rather than assuming repository access is required for Project visibility. Practical check is to inspect Project settings to confirm staff have edit and mentors have read, then validate with a mentor test account that items are visible but not editable and repositories remain inaccessible.