{
  "generatedAt": "2026-10-12T16:01:05.493Z",
  "description": "ghtier as a graph. Node ids are <type>:<id>. Edges: role includes permission and scope reaches permission (partial when only part of it is used); permission enables technique; technique achieves objective; entry-vector uses permission; incident abused permission and used technique or escalation; checklist-item mitigates technique; permission starts escalation, which gains permission.",
  "nodes": [
    {
      "id": "permission:enterprise_custom_enterprise_roles:write",
      "type": "permission",
      "label": "Custom enterprise roles: Write (enterprise)",
      "tier": 0,
      "url": "/tier/permissions/enterprise-custom-enterprise-roles-write"
    },
    {
      "id": "permission:enterprise_scim:write",
      "type": "permission",
      "label": "Enterprise SCIM: Write (enterprise)",
      "tier": 0,
      "url": "/tier/permissions/enterprise-scim-write"
    },
    {
      "id": "permission:enterprise_teams:write",
      "type": "permission",
      "label": "Enterprise teams: Write (enterprise)",
      "tier": 0,
      "url": "/tier/permissions/enterprise-teams-write"
    },
    {
      "id": "permission:organization_administration:write",
      "type": "permission",
      "label": "Administration: Write (organization)",
      "tier": 0,
      "url": "/tier/permissions/organization-administration-write"
    },
    {
      "id": "permission:members:write",
      "type": "permission",
      "label": "Members: Write (organization)",
      "tier": 0,
      "url": "/tier/permissions/members-write"
    },
    {
      "id": "permission:enterprise_custom_properties:write",
      "type": "permission",
      "label": "Custom properties: Write (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-custom-properties-write"
    },
    {
      "id": "permission:enterprise_credentials:write",
      "type": "permission",
      "label": "Enterprise credentials: Write (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-credentials-write"
    },
    {
      "id": "permission:enterprise_custom_properties_for_organizations:admin",
      "type": "permission",
      "label": "Enterprise custom properties for organizations: Admin (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-custom-properties-for-organizations-admin"
    },
    {
      "id": "permission:enterprise_custom_properties_for_organizations:write",
      "type": "permission",
      "label": "Enterprise custom properties for organizations: Write (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-custom-properties-for-organizations-write"
    },
    {
      "id": "permission:enterprise_organization_installation_repositories:write",
      "type": "permission",
      "label": "Enterprise organization installation repositories: Write (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-organization-installation-repositories-write"
    },
    {
      "id": "permission:enterprise_organization_installations:write",
      "type": "permission",
      "label": "Enterprise organization installations: Write (enterprise)",
      "tier": 1,
      "url": "/tier/permissions/enterprise-organization-installations-write"
    },
    {
      "id": "permission:organization_custom_org_roles:write",
      "type": "permission",
      "label": "Custom organization roles: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-custom-org-roles-write"
    },
    {
      "id": "permission:organization_custom_properties:admin",
      "type": "permission",
      "label": "Custom properties: Admin (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-custom-properties-admin"
    },
    {
      "id": "permission:organization_custom_properties:write",
      "type": "permission",
      "label": "Custom properties: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-custom-properties-write"
    },
    {
      "id": "permission:organization_custom_roles:write",
      "type": "permission",
      "label": "Custom repository roles: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-custom-roles-write"
    },
    {
      "id": "permission:organization_network_configurations:write",
      "type": "permission",
      "label": "Network configurations: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-network-configurations-write"
    },
    {
      "id": "permission:organization_private_registries:write",
      "type": "permission",
      "label": "Organization private registries: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-private-registries-write"
    },
    {
      "id": "permission:organization_personal_access_token_requests:write",
      "type": "permission",
      "label": "Personal access token requests: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-personal-access-token-requests-write"
    },
    {
      "id": "permission:organization_secrets:write",
      "type": "permission",
      "label": "Secrets: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-secrets-write"
    },
    {
      "id": "permission:organization_self_hosted_runners:write",
      "type": "permission",
      "label": "Self-hosted runners: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-self-hosted-runners-write"
    },
    {
      "id": "permission:organization_hooks:write",
      "type": "permission",
      "label": "Webhooks: Write (organization)",
      "tier": 1,
      "url": "/tier/permissions/organization-hooks-write"
    },
    {
      "id": "permission:actions:write",
      "type": "permission",
      "label": "Actions: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/actions-write"
    },
    {
      "id": "permission:administration:write",
      "type": "permission",
      "label": "Administration: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/administration-write"
    },
    {
      "id": "permission:repository_custom_properties:write",
      "type": "permission",
      "label": "Custom properties: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/repository-custom-properties-write"
    },
    {
      "id": "permission:environments:write",
      "type": "permission",
      "label": "Environments: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/environments-write"
    },
    {
      "id": "permission:installation_repositories:write",
      "type": "permission",
      "label": "GitHub App installation repository access: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/installation-repositories-write"
    },
    {
      "id": "permission:id_token:write",
      "type": "permission",
      "label": "OIDC ID token: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/id-token-write"
    },
    {
      "id": "permission:packages:write",
      "type": "permission",
      "label": "Packages: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/packages-write"
    },
    {
      "id": "permission:secret_scanning_alerts:read",
      "type": "permission",
      "label": "Secret scanning alerts: Read (repository)",
      "tier": 1,
      "url": "/tier/permissions/secret-scanning-alerts-read"
    },
    {
      "id": "permission:secrets:write",
      "type": "permission",
      "label": "Secrets: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/secrets-write"
    },
    {
      "id": "permission:repository_hooks:write",
      "type": "permission",
      "label": "Webhooks: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/repository-hooks-write"
    },
    {
      "id": "permission:workflows:write",
      "type": "permission",
      "label": "Workflows: Write (repository)",
      "tier": 1,
      "url": "/tier/permissions/workflows-write"
    },
    {
      "id": "permission:keys:write",
      "type": "permission",
      "label": "Git SSH keys: Write (user)",
      "tier": 1,
      "url": "/tier/permissions/keys-write"
    },
    {
      "id": "permission:enterprise_ai_controls:write",
      "type": "permission",
      "label": "Enterprise AI controls: Write (enterprise)",
      "tier": 2,
      "url": "/tier/permissions/enterprise-ai-controls-write"
    },
    {
      "id": "permission:enterprise_billing:write",
      "type": "permission",
      "label": "Enterprise billing: Write (enterprise)",
      "tier": 2,
      "url": "/tier/permissions/enterprise-billing-write"
    },
    {
      "id": "permission:enterprise_licensing:write",
      "type": "permission",
      "label": "Enterprise Licensing: Write (enterprise)",
      "tier": 2,
      "url": "/tier/permissions/enterprise-licensing-write"
    },
    {
      "id": "permission:organization_agent_secrets:write",
      "type": "permission",
      "label": "Agent secrets: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-agent-secrets-write"
    },
    {
      "id": "permission:organization_agent_variables:write",
      "type": "permission",
      "label": "Agent variables: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-agent-variables-write"
    },
    {
      "id": "permission:organization_copilot_agent_settings:write",
      "type": "permission",
      "label": "Copilot agent settings: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-copilot-agent-settings-write"
    },
    {
      "id": "permission:org_copilot_content_exclusion:write",
      "type": "permission",
      "label": "Copilot content exclusion: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/org-copilot-content-exclusion-write"
    },
    {
      "id": "permission:organization_copilot_spaces:write",
      "type": "permission",
      "label": "Copilot Spaces: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-copilot-spaces-write"
    },
    {
      "id": "permission:custom_properties_for_organizations:write",
      "type": "permission",
      "label": "Custom properties for organizations: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/custom-properties-for-organizations-write"
    },
    {
      "id": "permission:organization_external_properties_for_repos:admin",
      "type": "permission",
      "label": "External custom properties for repositories: Admin (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-external-properties-for-repos-admin"
    },
    {
      "id": "permission:organization_external_properties_for_repos:write",
      "type": "permission",
      "label": "External custom properties for repositories: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-external-properties-for-repos-write"
    },
    {
      "id": "permission:organization_runner_custom_images:write",
      "type": "permission",
      "label": "Hosted runner custom images: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-runner-custom-images-write"
    },
    {
      "id": "permission:organization_secret_scanning_bypass_requests:write",
      "type": "permission",
      "label": "Organization bypass requests for secret scanning: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-secret-scanning-bypass-requests-write"
    },
    {
      "id": "permission:organization_codespaces:write",
      "type": "permission",
      "label": "Organization codespaces: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-codespaces-write"
    },
    {
      "id": "permission:organization_codespaces_secrets:write",
      "type": "permission",
      "label": "Organization codespaces secrets: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-codespaces-secrets-write"
    },
    {
      "id": "permission:organization_codespaces_settings:write",
      "type": "permission",
      "label": "Organization codespaces settings: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-codespaces-settings-write"
    },
    {
      "id": "permission:organization_dependabot_secrets:write",
      "type": "permission",
      "label": "Organization dependabot secrets: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-dependabot-secrets-write"
    },
    {
      "id": "permission:organization_code_scanning_dismissal_requests:write",
      "type": "permission",
      "label": "Organization dismissal requests for code scanning: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-code-scanning-dismissal-requests-write"
    },
    {
      "id": "permission:organization_dependabot_dismissal_requests:write",
      "type": "permission",
      "label": "Organization dismissal requests for Dependabot: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-dependabot-dismissal-requests-write"
    },
    {
      "id": "permission:organization_personal_access_tokens:write",
      "type": "permission",
      "label": "Personal access tokens: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-personal-access-tokens-write"
    },
    {
      "id": "permission:secret_scanning_dismissal_requests:write",
      "type": "permission",
      "label": "Secret scanning alert dismissal requests: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/secret-scanning-dismissal-requests-write"
    },
    {
      "id": "permission:organization_actions_variables:write",
      "type": "permission",
      "label": "Variables: Write (organization)",
      "tier": 2,
      "url": "/tier/permissions/organization-actions-variables-write"
    },
    {
      "id": "permission:agent_secrets:write",
      "type": "permission",
      "label": "Agent secrets: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/agent-secrets-write"
    },
    {
      "id": "permission:agent_variables:write",
      "type": "permission",
      "label": "Agent variables: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/agent-variables-write"
    },
    {
      "id": "permission:artifact_metadata:write",
      "type": "permission",
      "label": "Artifact metadata: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/artifact-metadata-write"
    },
    {
      "id": "permission:attestations:write",
      "type": "permission",
      "label": "Attestations: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/attestations-write"
    },
    {
      "id": "permission:checks:write",
      "type": "permission",
      "label": "Checks: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/checks-write"
    },
    {
      "id": "permission:security_events:write",
      "type": "permission",
      "label": "Code scanning alerts: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/security-events-write"
    },
    {
      "id": "permission:codespaces:write",
      "type": "permission",
      "label": "Codespaces: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/codespaces-write"
    },
    {
      "id": "permission:codespaces_lifecycle_admin:write",
      "type": "permission",
      "label": "Codespaces lifecycle admin: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/codespaces-lifecycle-admin-write"
    },
    {
      "id": "permission:codespaces_secrets:write",
      "type": "permission",
      "label": "Codespaces secrets: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/codespaces-secrets-write"
    },
    {
      "id": "permission:statuses:write",
      "type": "permission",
      "label": "Commit statuses: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/statuses-write"
    },
    {
      "id": "permission:contents:write",
      "type": "permission",
      "label": "Contents: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/contents-write"
    },
    {
      "id": "permission:vulnerability_alerts:write",
      "type": "permission",
      "label": "Dependabot alerts: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/vulnerability-alerts-write"
    },
    {
      "id": "permission:dependabot_secrets:write",
      "type": "permission",
      "label": "Dependabot secrets: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/dependabot-secrets-write"
    },
    {
      "id": "permission:deployments:write",
      "type": "permission",
      "label": "Deployments: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/deployments-write"
    },
    {
      "id": "permission:discussions:write",
      "type": "permission",
      "label": "Discussions: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/discussions-write"
    },
    {
      "id": "permission:issues:write",
      "type": "permission",
      "label": "Issues: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/issues-write"
    },
    {
      "id": "permission:pages:write",
      "type": "permission",
      "label": "Pages: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/pages-write"
    },
    {
      "id": "permission:pull_requests:write",
      "type": "permission",
      "label": "Pull requests: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/pull-requests-write"
    },
    {
      "id": "permission:repository_creation:write",
      "type": "permission",
      "label": "Repository creation: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/repository-creation-write"
    },
    {
      "id": "permission:repository_advisories:write",
      "type": "permission",
      "label": "Repository security advisories: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/repository-advisories-write"
    },
    {
      "id": "permission:repo_secret_scanning_dismissal_requests:write",
      "type": "permission",
      "label": "Secret scanning alert dismissal requests: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/repo-secret-scanning-dismissal-requests-write"
    },
    {
      "id": "permission:secret_scanning_alerts:write",
      "type": "permission",
      "label": "Secret scanning alerts: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/secret-scanning-alerts-write"
    },
    {
      "id": "permission:secret_scanning_bypass_requests:write",
      "type": "permission",
      "label": "Secret scanning push protection bypass requests: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/secret-scanning-bypass-requests-write"
    },
    {
      "id": "permission:actions_variables:write",
      "type": "permission",
      "label": "Variables: Write (repository)",
      "tier": 2,
      "url": "/tier/permissions/actions-variables-write"
    },
    {
      "id": "permission:codespaces_user_secrets:write",
      "type": "permission",
      "label": "Codespaces user secrets: Write (user)",
      "tier": 2,
      "url": "/tier/permissions/codespaces-user-secrets-write"
    },
    {
      "id": "permission:emails:write",
      "type": "permission",
      "label": "Email addresses: Write (user)",
      "tier": 2,
      "url": "/tier/permissions/emails-write"
    },
    {
      "id": "permission:gpg_keys:write",
      "type": "permission",
      "label": "GPG keys: Write (user)",
      "tier": 2,
      "url": "/tier/permissions/gpg-keys-write"
    },
    {
      "id": "permission:git_signing_ssh_public_keys:write",
      "type": "permission",
      "label": "SSH signing keys: Write (user)",
      "tier": 2,
      "url": "/tier/permissions/git-signing-ssh-public-keys-write"
    },
    {
      "id": "permission:enterprise_copilot_usage:read",
      "type": "permission",
      "label": "Copilot usage records: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-copilot-usage-read"
    },
    {
      "id": "permission:enterprise_custom_enterprise_roles:read",
      "type": "permission",
      "label": "Custom enterprise roles: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-custom-enterprise-roles-read"
    },
    {
      "id": "permission:enterprise_custom_properties:read",
      "type": "permission",
      "label": "Custom properties: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-custom-properties-read"
    },
    {
      "id": "permission:enterprise_ai_controls:read",
      "type": "permission",
      "label": "Enterprise AI controls: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-ai-controls-read"
    },
    {
      "id": "permission:enterprise_billing:read",
      "type": "permission",
      "label": "Enterprise billing: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-billing-read"
    },
    {
      "id": "permission:enterprise_copilot_metrics:read",
      "type": "permission",
      "label": "Enterprise Copilot metrics: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-copilot-metrics-read"
    },
    {
      "id": "permission:enterprise_credentials:read",
      "type": "permission",
      "label": "Enterprise credentials: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-credentials-read"
    },
    {
      "id": "permission:enterprise_custom_properties_for_organizations:read",
      "type": "permission",
      "label": "Enterprise custom properties for organizations: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-custom-properties-for-organizations-read"
    },
    {
      "id": "permission:enterprise_innersource_vulnerabilities:write",
      "type": "permission",
      "label": "Enterprise innersource vulnerabilities: Write (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-innersource-vulnerabilities-write"
    },
    {
      "id": "permission:enterprise_licensing:read",
      "type": "permission",
      "label": "Enterprise Licensing: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-licensing-read"
    },
    {
      "id": "permission:enterprise_organization_installation_repositories:read",
      "type": "permission",
      "label": "Enterprise organization installation repositories: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-organization-installation-repositories-read"
    },
    {
      "id": "permission:enterprise_organization_installations:read",
      "type": "permission",
      "label": "Enterprise organization installations: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-organization-installations-read"
    },
    {
      "id": "permission:enterprise_scim:read",
      "type": "permission",
      "label": "Enterprise SCIM: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-scim-read"
    },
    {
      "id": "permission:enterprise_teams:read",
      "type": "permission",
      "label": "Enterprise teams: Read (enterprise)",
      "tier": 3,
      "url": "/tier/permissions/enterprise-teams-read"
    },
    {
      "id": "permission:organization_administration:read",
      "type": "permission",
      "label": "Administration: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-administration-read"
    },
    {
      "id": "permission:organization_agent_secrets:read",
      "type": "permission",
      "label": "Agent secrets: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-agent-secrets-read"
    },
    {
      "id": "permission:organization_agent_variables:read",
      "type": "permission",
      "label": "Agent variables: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-agent-variables-read"
    },
    {
      "id": "permission:organization_api_insights:read",
      "type": "permission",
      "label": "API Insights: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-api-insights-read"
    },
    {
      "id": "permission:organization_user_blocking:read",
      "type": "permission",
      "label": "Blocking users: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-user-blocking-read"
    },
    {
      "id": "permission:organization_user_blocking:write",
      "type": "permission",
      "label": "Blocking users: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-user-blocking-write"
    },
    {
      "id": "permission:organization_campaigns:read",
      "type": "permission",
      "label": "Campaigns: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-campaigns-read"
    },
    {
      "id": "permission:organization_campaigns:write",
      "type": "permission",
      "label": "Campaigns: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-campaigns-write"
    },
    {
      "id": "permission:organization_copilot_agent_settings:read",
      "type": "permission",
      "label": "Copilot agent settings: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-copilot-agent-settings-read"
    },
    {
      "id": "permission:org_copilot_content_exclusion:read",
      "type": "permission",
      "label": "Copilot content exclusion: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/org-copilot-content-exclusion-read"
    },
    {
      "id": "permission:organization_copilot_spaces:read",
      "type": "permission",
      "label": "Copilot Spaces: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-copilot-spaces-read"
    },
    {
      "id": "permission:organization_custom_org_roles:read",
      "type": "permission",
      "label": "Custom organization roles: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-custom-org-roles-read"
    },
    {
      "id": "permission:organization_custom_properties:read",
      "type": "permission",
      "label": "Custom properties: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-custom-properties-read"
    },
    {
      "id": "permission:custom_properties_for_organizations:read",
      "type": "permission",
      "label": "Custom properties for organizations: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/custom-properties-for-organizations-read"
    },
    {
      "id": "permission:organization_custom_roles:read",
      "type": "permission",
      "label": "Custom repository roles: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-custom-roles-read"
    },
    {
      "id": "permission:organization_events:read",
      "type": "permission",
      "label": "Events: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-events-read"
    },
    {
      "id": "permission:organization_external_properties_for_repos:read",
      "type": "permission",
      "label": "External custom properties for repositories: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-external-properties-for-repos-read"
    },
    {
      "id": "permission:organization_copilot_seat_management:read",
      "type": "permission",
      "label": "GitHub Copilot Business: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-copilot-seat-management-read"
    },
    {
      "id": "permission:organization_copilot_seat_management:write",
      "type": "permission",
      "label": "GitHub Copilot Business: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-copilot-seat-management-write"
    },
    {
      "id": "permission:organization_runner_custom_images:read",
      "type": "permission",
      "label": "Hosted runner custom images: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-runner-custom-images-read"
    },
    {
      "id": "permission:issue_fields:read",
      "type": "permission",
      "label": "Issue Fields: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/issue-fields-read"
    },
    {
      "id": "permission:issue_fields:write",
      "type": "permission",
      "label": "Issue Fields: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/issue-fields-write"
    },
    {
      "id": "permission:issue_types:read",
      "type": "permission",
      "label": "Issue Types: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/issue-types-read"
    },
    {
      "id": "permission:issue_types:write",
      "type": "permission",
      "label": "Issue Types: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/issue-types-write"
    },
    {
      "id": "permission:members:read",
      "type": "permission",
      "label": "Members: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/members-read"
    },
    {
      "id": "permission:organization_network_configurations:read",
      "type": "permission",
      "label": "Network configurations: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-network-configurations-read"
    },
    {
      "id": "permission:organization_announcement_banners:read",
      "type": "permission",
      "label": "Organization announcement banners: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-announcement-banners-read"
    },
    {
      "id": "permission:organization_announcement_banners:write",
      "type": "permission",
      "label": "Organization announcement banners: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-announcement-banners-write"
    },
    {
      "id": "permission:organization_secret_scanning_bypass_requests:read",
      "type": "permission",
      "label": "Organization bypass requests for secret scanning: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-secret-scanning-bypass-requests-read"
    },
    {
      "id": "permission:organization_codespaces:read",
      "type": "permission",
      "label": "Organization codespaces: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-codespaces-read"
    },
    {
      "id": "permission:organization_codespaces_secrets:read",
      "type": "permission",
      "label": "Organization codespaces secrets: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-codespaces-secrets-read"
    },
    {
      "id": "permission:organization_copilot_metrics:read",
      "type": "permission",
      "label": "Organization Copilot metrics: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-copilot-metrics-read"
    },
    {
      "id": "permission:organization_dependabot_secrets:read",
      "type": "permission",
      "label": "Organization dependabot secrets: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-dependabot-secrets-read"
    },
    {
      "id": "permission:organization_code_scanning_dismissal_requests:read",
      "type": "permission",
      "label": "Organization dismissal requests for code scanning: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-code-scanning-dismissal-requests-read"
    },
    {
      "id": "permission:organization_dependabot_dismissal_requests:read",
      "type": "permission",
      "label": "Organization dismissal requests for Dependabot: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-dependabot-dismissal-requests-read"
    },
    {
      "id": "permission:organization_private_registries:read",
      "type": "permission",
      "label": "Organization private registries: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-private-registries-read"
    },
    {
      "id": "permission:organization_personal_access_token_requests:read",
      "type": "permission",
      "label": "Personal access token requests: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-personal-access-token-requests-read"
    },
    {
      "id": "permission:organization_personal_access_tokens:read",
      "type": "permission",
      "label": "Personal access tokens: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-personal-access-tokens-read"
    },
    {
      "id": "permission:organization_projects:read",
      "type": "permission",
      "label": "Projects: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-projects-read"
    },
    {
      "id": "permission:organization_projects:write",
      "type": "permission",
      "label": "Projects: Write (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-projects-write"
    },
    {
      "id": "permission:secret_scanning_dismissal_requests:read",
      "type": "permission",
      "label": "Secret scanning alert dismissal requests: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/secret-scanning-dismissal-requests-read"
    },
    {
      "id": "permission:organization_secrets:read",
      "type": "permission",
      "label": "Secrets: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-secrets-read"
    },
    {
      "id": "permission:organization_self_hosted_runners:read",
      "type": "permission",
      "label": "Self-hosted runners: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-self-hosted-runners-read"
    },
    {
      "id": "permission:organization_actions_variables:read",
      "type": "permission",
      "label": "Variables: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-actions-variables-read"
    },
    {
      "id": "permission:organization_hooks:read",
      "type": "permission",
      "label": "Webhooks: Read (organization)",
      "tier": 3,
      "url": "/tier/permissions/organization-hooks-read"
    },
    {
      "id": "permission:actions:read",
      "type": "permission",
      "label": "Actions: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/actions-read"
    },
    {
      "id": "permission:administration:read",
      "type": "permission",
      "label": "Administration: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/administration-read"
    },
    {
      "id": "permission:agent_secrets:read",
      "type": "permission",
      "label": "Agent secrets: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/agent-secrets-read"
    },
    {
      "id": "permission:agent_variables:read",
      "type": "permission",
      "label": "Agent variables: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/agent-variables-read"
    },
    {
      "id": "permission:artifact_metadata:read",
      "type": "permission",
      "label": "Artifact metadata: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/artifact-metadata-read"
    },
    {
      "id": "permission:attestations:read",
      "type": "permission",
      "label": "Attestations: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/attestations-read"
    },
    {
      "id": "permission:checks:read",
      "type": "permission",
      "label": "Checks: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/checks-read"
    },
    {
      "id": "permission:code_quality:read",
      "type": "permission",
      "label": "Code quality: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/code-quality-read"
    },
    {
      "id": "permission:security_events:read",
      "type": "permission",
      "label": "Code scanning alerts: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/security-events-read"
    },
    {
      "id": "permission:codespaces:read",
      "type": "permission",
      "label": "Codespaces: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/codespaces-read"
    },
    {
      "id": "permission:codespaces_lifecycle_admin:read",
      "type": "permission",
      "label": "Codespaces lifecycle admin: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/codespaces-lifecycle-admin-read"
    },
    {
      "id": "permission:codespaces_metadata:read",
      "type": "permission",
      "label": "Codespaces metadata: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/codespaces-metadata-read"
    },
    {
      "id": "permission:statuses:read",
      "type": "permission",
      "label": "Commit statuses: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/statuses-read"
    },
    {
      "id": "permission:contents:read",
      "type": "permission",
      "label": "Contents: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/contents-read"
    },
    {
      "id": "permission:copilot_agent_settings:read",
      "type": "permission",
      "label": "Copilot agent settings: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/copilot-agent-settings-read"
    },
    {
      "id": "permission:vulnerability_alerts:read",
      "type": "permission",
      "label": "Dependabot alerts: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/vulnerability-alerts-read"
    },
    {
      "id": "permission:dependabot_secrets:read",
      "type": "permission",
      "label": "Dependabot secrets: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/dependabot-secrets-read"
    },
    {
      "id": "permission:deployments:read",
      "type": "permission",
      "label": "Deployments: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/deployments-read"
    },
    {
      "id": "permission:discussions:read",
      "type": "permission",
      "label": "Discussions: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/discussions-read"
    },
    {
      "id": "permission:environments:read",
      "type": "permission",
      "label": "Environments: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/environments-read"
    },
    {
      "id": "permission:issues:read",
      "type": "permission",
      "label": "Issues: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/issues-read"
    },
    {
      "id": "permission:metadata:read",
      "type": "permission",
      "label": "Metadata: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/metadata-read"
    },
    {
      "id": "permission:packages:read",
      "type": "permission",
      "label": "Packages: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/packages-read"
    },
    {
      "id": "permission:pages:read",
      "type": "permission",
      "label": "Pages: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/pages-read"
    },
    {
      "id": "permission:pull_requests:read",
      "type": "permission",
      "label": "Pull requests: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/pull-requests-read"
    },
    {
      "id": "permission:repository_advisories:read",
      "type": "permission",
      "label": "Repository security advisories: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/repository-advisories-read"
    },
    {
      "id": "permission:repo_secret_scanning_dismissal_requests:read",
      "type": "permission",
      "label": "Secret scanning alert dismissal requests: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/repo-secret-scanning-dismissal-requests-read"
    },
    {
      "id": "permission:secret_scanning_bypass_requests:read",
      "type": "permission",
      "label": "Secret scanning push protection bypass requests: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/secret-scanning-bypass-requests-read"
    },
    {
      "id": "permission:secrets:read",
      "type": "permission",
      "label": "Secrets: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/secrets-read"
    },
    {
      "id": "permission:actions_variables:read",
      "type": "permission",
      "label": "Variables: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/actions-variables-read"
    },
    {
      "id": "permission:repository_hooks:read",
      "type": "permission",
      "label": "Webhooks: Read (repository)",
      "tier": 3,
      "url": "/tier/permissions/repository-hooks-read"
    },
    {
      "id": "permission:blocking:read",
      "type": "permission",
      "label": "Block another user: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/blocking-read"
    },
    {
      "id": "permission:blocking:write",
      "type": "permission",
      "label": "Block another user: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/blocking-write"
    },
    {
      "id": "permission:codespaces_user_secrets:read",
      "type": "permission",
      "label": "Codespaces user secrets: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/codespaces-user-secrets-read"
    },
    {
      "id": "permission:emails:read",
      "type": "permission",
      "label": "Email addresses: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/emails-read"
    },
    {
      "id": "permission:followers:read",
      "type": "permission",
      "label": "Followers: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/followers-read"
    },
    {
      "id": "permission:followers:write",
      "type": "permission",
      "label": "Followers: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/followers-write"
    },
    {
      "id": "permission:gists:write",
      "type": "permission",
      "label": "Gists: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/gists-write"
    },
    {
      "id": "permission:keys:read",
      "type": "permission",
      "label": "Git SSH keys: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/keys-read"
    },
    {
      "id": "permission:gpg_keys:read",
      "type": "permission",
      "label": "GPG keys: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/gpg-keys-read"
    },
    {
      "id": "permission:interaction_limits:read",
      "type": "permission",
      "label": "Interaction limits: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/interaction-limits-read"
    },
    {
      "id": "permission:interaction_limits:write",
      "type": "permission",
      "label": "Interaction limits: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/interaction-limits-write"
    },
    {
      "id": "permission:private_repository_invitations:read",
      "type": "permission",
      "label": "Private repository invitations: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/private-repository-invitations-read"
    },
    {
      "id": "permission:profile:write",
      "type": "permission",
      "label": "Profile: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/profile-write"
    },
    {
      "id": "permission:git_signing_ssh_public_keys:read",
      "type": "permission",
      "label": "SSH signing keys: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/git-signing-ssh-public-keys-read"
    },
    {
      "id": "permission:starring:read",
      "type": "permission",
      "label": "Starring: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/starring-read"
    },
    {
      "id": "permission:starring:write",
      "type": "permission",
      "label": "Starring: Write (user)",
      "tier": 3,
      "url": "/tier/permissions/starring-write"
    },
    {
      "id": "permission:watching:read",
      "type": "permission",
      "label": "Watching: Read (user)",
      "tier": 3,
      "url": "/tier/permissions/watching-read"
    },
    {
      "id": "role:repo-read",
      "type": "role",
      "label": "Read",
      "tier": 3,
      "url": "/tier/roles/repo-read"
    },
    {
      "id": "role:repo-triage",
      "type": "role",
      "label": "Triage",
      "tier": 2,
      "url": "/tier/roles/repo-triage"
    },
    {
      "id": "role:repo-write",
      "type": "role",
      "label": "Write",
      "tier": 1,
      "url": "/tier/roles/repo-write"
    },
    {
      "id": "role:repo-maintain",
      "type": "role",
      "label": "Maintain",
      "tier": 1,
      "url": "/tier/roles/repo-maintain"
    },
    {
      "id": "role:repo-admin",
      "type": "role",
      "label": "Admin",
      "tier": 1,
      "url": "/tier/roles/repo-admin"
    },
    {
      "id": "role:personal-repo-collaborator",
      "type": "role",
      "label": "Collaborator on a personal repository",
      "tier": 1,
      "url": "/tier/roles/personal-repo-collaborator"
    },
    {
      "id": "role:org-owner",
      "type": "role",
      "label": "Owner",
      "tier": 0,
      "url": "/tier/roles/org-owner"
    },
    {
      "id": "role:org-member",
      "type": "role",
      "label": "Member",
      "tier": 2,
      "url": "/tier/roles/org-member"
    },
    {
      "id": "role:org-moderator",
      "type": "role",
      "label": "Moderator",
      "tier": 2,
      "url": "/tier/roles/org-moderator"
    },
    {
      "id": "role:org-billing-manager",
      "type": "role",
      "label": "Billing manager",
      "tier": 3,
      "url": "/tier/roles/org-billing-manager"
    },
    {
      "id": "role:org-security-manager",
      "type": "role",
      "label": "Security manager",
      "tier": 1,
      "url": "/tier/roles/org-security-manager"
    },
    {
      "id": "role:org-app-manager",
      "type": "role",
      "label": "App manager",
      "tier": 1,
      "url": "/tier/roles/org-app-manager"
    },
    {
      "id": "role:org-cicd-admin",
      "type": "role",
      "label": "CI/CD admin",
      "tier": 1,
      "url": "/tier/roles/org-cicd-admin"
    },
    {
      "id": "role:org-all-repo-read",
      "type": "role",
      "label": "All-repository read",
      "tier": 3,
      "url": "/tier/roles/org-all-repo-read"
    },
    {
      "id": "role:org-all-repo-triage",
      "type": "role",
      "label": "All-repository triage",
      "tier": 2,
      "url": "/tier/roles/org-all-repo-triage"
    },
    {
      "id": "role:org-all-repo-write",
      "type": "role",
      "label": "All-repository write",
      "tier": 1,
      "url": "/tier/roles/org-all-repo-write"
    },
    {
      "id": "role:org-all-repo-maintain",
      "type": "role",
      "label": "All-repository maintain",
      "tier": 1,
      "url": "/tier/roles/org-all-repo-maintain"
    },
    {
      "id": "role:org-all-repo-admin",
      "type": "role",
      "label": "All-repository admin",
      "tier": 0,
      "url": "/tier/roles/org-all-repo-admin"
    },
    {
      "id": "role:team-maintainer",
      "type": "role",
      "label": "Team maintainer",
      "tier": 1,
      "url": "/tier/roles/team-maintainer"
    },
    {
      "id": "role:enterprise-owner",
      "type": "role",
      "label": "Enterprise owner",
      "tier": 0,
      "url": "/tier/roles/enterprise-owner"
    },
    {
      "id": "role:enterprise-billing-manager",
      "type": "role",
      "label": "Enterprise billing manager",
      "tier": 2,
      "url": "/tier/roles/enterprise-billing-manager"
    },
    {
      "id": "role:enterprise-app-manager",
      "type": "role",
      "label": "Enterprise App manager",
      "tier": 1,
      "url": "/tier/roles/enterprise-app-manager"
    },
    {
      "id": "role:enterprise-security-manager",
      "type": "role",
      "label": "Enterprise security manager",
      "tier": 1,
      "url": "/tier/roles/enterprise-security-manager"
    },
    {
      "id": "role:enterprise-user",
      "type": "role",
      "label": "Enterprise user",
      "tier": 3,
      "url": "/tier/roles/enterprise-user"
    },
    {
      "id": "role:enterprise-guest-collaborator",
      "type": "role",
      "label": "Guest collaborator",
      "tier": 3,
      "url": "/tier/roles/enterprise-guest-collaborator"
    },
    {
      "id": "role:ghes-site-admin",
      "type": "role",
      "label": "Site administrator (Enterprise Server)",
      "tier": 0,
      "url": "/tier/roles/ghes-site-admin"
    },
    {
      "id": "scope:(no scope)",
      "type": "scope",
      "label": "(no scope)",
      "tier": 3,
      "url": "/tier/tokens/no-scope"
    },
    {
      "id": "scope:repo",
      "type": "scope",
      "label": "repo",
      "tier": 0,
      "url": "/tier/tokens/repo"
    },
    {
      "id": "scope:repo:status",
      "type": "scope",
      "label": "repo:status",
      "tier": 2,
      "url": "/tier/tokens/repo-status"
    },
    {
      "id": "scope:repo_deployment",
      "type": "scope",
      "label": "repo_deployment",
      "tier": 2,
      "url": "/tier/tokens/repo-deployment"
    },
    {
      "id": "scope:public_repo",
      "type": "scope",
      "label": "public_repo",
      "tier": 2,
      "url": "/tier/tokens/public-repo"
    },
    {
      "id": "scope:repo:invite",
      "type": "scope",
      "label": "repo:invite",
      "tier": 3,
      "url": "/tier/tokens/repo-invite"
    },
    {
      "id": "scope:security_events",
      "type": "scope",
      "label": "security_events",
      "tier": 1,
      "url": "/tier/tokens/security-events"
    },
    {
      "id": "scope:admin:repo_hook",
      "type": "scope",
      "label": "admin:repo_hook",
      "tier": 1,
      "url": "/tier/tokens/admin-repo-hook"
    },
    {
      "id": "scope:write:repo_hook",
      "type": "scope",
      "label": "write:repo_hook",
      "tier": 1,
      "url": "/tier/tokens/write-repo-hook"
    },
    {
      "id": "scope:read:repo_hook",
      "type": "scope",
      "label": "read:repo_hook",
      "tier": 3,
      "url": "/tier/tokens/read-repo-hook"
    },
    {
      "id": "scope:admin:org",
      "type": "scope",
      "label": "admin:org",
      "tier": 0,
      "url": "/tier/tokens/admin-org"
    },
    {
      "id": "scope:write:org",
      "type": "scope",
      "label": "write:org",
      "tier": 1,
      "url": "/tier/tokens/write-org"
    },
    {
      "id": "scope:read:org",
      "type": "scope",
      "label": "read:org",
      "tier": 2,
      "url": "/tier/tokens/read-org"
    },
    {
      "id": "scope:admin:public_key",
      "type": "scope",
      "label": "admin:public_key",
      "tier": 1,
      "url": "/tier/tokens/admin-public-key"
    },
    {
      "id": "scope:write:public_key",
      "type": "scope",
      "label": "write:public_key",
      "tier": 1,
      "url": "/tier/tokens/write-public-key"
    },
    {
      "id": "scope:read:public_key",
      "type": "scope",
      "label": "read:public_key",
      "tier": 3,
      "url": "/tier/tokens/read-public-key"
    },
    {
      "id": "scope:admin:org_hook",
      "type": "scope",
      "label": "admin:org_hook",
      "tier": 1,
      "url": "/tier/tokens/admin-org-hook"
    },
    {
      "id": "scope:gist",
      "type": "scope",
      "label": "gist",
      "tier": 3,
      "url": "/tier/tokens/gist"
    },
    {
      "id": "scope:notifications",
      "type": "scope",
      "label": "notifications",
      "tier": 3,
      "url": "/tier/tokens/notifications"
    },
    {
      "id": "scope:user",
      "type": "scope",
      "label": "user",
      "tier": 2,
      "url": "/tier/tokens/user"
    },
    {
      "id": "scope:read:user",
      "type": "scope",
      "label": "read:user",
      "tier": 3,
      "url": "/tier/tokens/read-user"
    },
    {
      "id": "scope:user:email",
      "type": "scope",
      "label": "user:email",
      "tier": 3,
      "url": "/tier/tokens/user-email"
    },
    {
      "id": "scope:user:follow",
      "type": "scope",
      "label": "user:follow",
      "tier": 3,
      "url": "/tier/tokens/user-follow"
    },
    {
      "id": "scope:project",
      "type": "scope",
      "label": "project",
      "tier": 3,
      "url": "/tier/tokens/project"
    },
    {
      "id": "scope:read:project",
      "type": "scope",
      "label": "read:project",
      "tier": 3,
      "url": "/tier/tokens/read-project"
    },
    {
      "id": "scope:delete_repo",
      "type": "scope",
      "label": "delete_repo",
      "tier": 1,
      "url": "/tier/tokens/delete-repo"
    },
    {
      "id": "scope:write:packages",
      "type": "scope",
      "label": "write:packages",
      "tier": 1,
      "url": "/tier/tokens/write-packages"
    },
    {
      "id": "scope:read:packages",
      "type": "scope",
      "label": "read:packages",
      "tier": 3,
      "url": "/tier/tokens/read-packages"
    },
    {
      "id": "scope:delete:packages",
      "type": "scope",
      "label": "delete:packages",
      "tier": 2,
      "url": "/tier/tokens/delete-packages"
    },
    {
      "id": "scope:admin:gpg_key",
      "type": "scope",
      "label": "admin:gpg_key",
      "tier": 2,
      "url": "/tier/tokens/admin-gpg-key"
    },
    {
      "id": "scope:write:gpg_key",
      "type": "scope",
      "label": "write:gpg_key",
      "tier": 2,
      "url": "/tier/tokens/write-gpg-key"
    },
    {
      "id": "scope:read:gpg_key",
      "type": "scope",
      "label": "read:gpg_key",
      "tier": 3,
      "url": "/tier/tokens/read-gpg-key"
    },
    {
      "id": "scope:codespace",
      "type": "scope",
      "label": "codespace",
      "tier": 2,
      "url": "/tier/tokens/codespace"
    },
    {
      "id": "scope:workflow",
      "type": "scope",
      "label": "workflow",
      "tier": 1,
      "url": "/tier/tokens/workflow"
    },
    {
      "id": "scope:admin:enterprise",
      "type": "scope",
      "label": "admin:enterprise",
      "tier": 0,
      "url": "/tier/tokens/admin-enterprise"
    },
    {
      "id": "scope:manage_runners:enterprise",
      "type": "scope",
      "label": "manage_runners:enterprise",
      "tier": 1,
      "url": "/tier/tokens/manage-runners-enterprise"
    },
    {
      "id": "scope:manage_billing:enterprise",
      "type": "scope",
      "label": "manage_billing:enterprise",
      "tier": 2,
      "url": "/tier/tokens/manage-billing-enterprise"
    },
    {
      "id": "scope:read:enterprise",
      "type": "scope",
      "label": "read:enterprise",
      "tier": 3,
      "url": "/tier/tokens/read-enterprise"
    },
    {
      "id": "scope:read:audit_log",
      "type": "scope",
      "label": "read:audit_log",
      "tier": 3,
      "url": "/tier/tokens/read-audit-log"
    },
    {
      "id": "scope:offline_access",
      "type": "scope",
      "label": "offline_access",
      "tier": 3,
      "url": "/tier/tokens/offline-access"
    },
    {
      "id": "scope:site_admin",
      "type": "scope",
      "label": "site_admin",
      "tier": 0,
      "url": "/tier/tokens/site-admin"
    },
    {
      "id": "objective:submit-code",
      "type": "objective",
      "label": "Submit malicious code",
      "url": "/attack-paths#submit-code"
    },
    {
      "id": "technique:no-review",
      "type": "technique",
      "label": "Push directly, without review",
      "url": "/attack-paths#technique-no-review"
    },
    {
      "id": "technique:sock-puppet",
      "type": "technique",
      "label": "Approve your own PR from a second account",
      "url": "/attack-paths#technique-sock-puppet"
    },
    {
      "id": "technique:robot-approval",
      "type": "technique",
      "label": "Have a workflow approve the PR",
      "url": "/attack-paths#technique-robot-approval"
    },
    {
      "id": "technique:stale-approval",
      "type": "technique",
      "label": "Push more commits after approval",
      "url": "/attack-paths#technique-stale-approval"
    },
    {
      "id": "technique:last-push",
      "type": "technique",
      "label": "Approve someone else's PR, then push to it",
      "url": "/attack-paths#technique-last-push"
    },
    {
      "id": "technique:unreviewable",
      "type": "technique",
      "label": "Hide it in a change nobody can review",
      "url": "/attack-paths#technique-unreviewable"
    },
    {
      "id": "technique:other-account",
      "type": "technique",
      "label": "Use a trusted colleague's account",
      "url": "/attack-paths#technique-other-account"
    },
    {
      "id": "technique:trick-reviewer",
      "type": "technique",
      "label": "Trick or outlast the reviewer",
      "url": "/attack-paths#technique-trick-reviewer"
    },
    {
      "id": "technique:admin-bypass",
      "type": "technique",
      "label": "Bypass or switch off the rules",
      "url": "/attack-paths#technique-admin-bypass"
    },
    {
      "id": "objective:delete-history",
      "type": "objective",
      "label": "Delete code or cover tracks",
      "url": "/attack-paths#delete-history"
    },
    {
      "id": "technique:force-push",
      "type": "technique",
      "label": "Force push or delete a protected branch",
      "url": "/attack-paths#technique-force-push"
    },
    {
      "id": "technique:delete-runs",
      "type": "technique",
      "label": "Delete branches and workflow runs",
      "url": "/attack-paths#technique-delete-runs"
    },
    {
      "id": "objective:release-tag",
      "type": "objective",
      "label": "Point a release tag at a bad commit",
      "url": "/attack-paths#release-tag"
    },
    {
      "id": "technique:push-tag",
      "type": "technique",
      "label": "Push a release tag to an unreviewed commit",
      "url": "/attack-paths#technique-push-tag"
    },
    {
      "id": "technique:repoint-tags",
      "type": "technique",
      "label": "Repoint existing tags on a published Action",
      "url": "/attack-paths#technique-repoint-tags"
    },
    {
      "id": "objective:steal-secrets",
      "type": "objective",
      "label": "Steal CI secrets and tokens",
      "url": "/attack-paths#steal-secrets"
    },
    {
      "id": "technique:inject-workflow",
      "type": "technique",
      "label": "Add a workflow that dumps secrets",
      "url": "/attack-paths#technique-inject-workflow"
    },
    {
      "id": "technique:pwn-request",
      "type": "technique",
      "label": "Run PR code in a privileged workflow",
      "url": "/attack-paths#technique-pwn-request"
    },
    {
      "id": "technique:runner-memory",
      "type": "technique",
      "label": "Read secrets from the runner",
      "url": "/attack-paths#technique-runner-memory"
    },
    {
      "id": "technique:session-theft",
      "type": "technique",
      "label": "Steal a session and read secrets from a CI vendor",
      "url": "/attack-paths#technique-session-theft"
    },
    {
      "id": "objective:poison-build",
      "type": "objective",
      "label": "Poison the build or published package",
      "url": "/attack-paths#poison-build"
    },
    {
      "id": "technique:cache-poison",
      "type": "technique",
      "label": "Poison a shared Actions cache",
      "url": "/attack-paths#technique-cache-poison"
    },
    {
      "id": "technique:dispatch-publish",
      "type": "technique",
      "label": "Trigger the publish workflow from a tampered branch",
      "url": "/attack-paths#technique-dispatch-publish"
    },
    {
      "id": "technique:runner-backdoor",
      "type": "technique",
      "label": "Backdoor a persistent self-hosted runner",
      "url": "/attack-paths#technique-runner-backdoor"
    },
    {
      "id": "technique:malicious-release",
      "type": "technique",
      "label": "Publish a malicious version with a stolen token",
      "url": "/attack-paths#technique-malicious-release"
    },
    {
      "id": "objective:expose-code",
      "type": "objective",
      "label": "Read or expose private code",
      "url": "/attack-paths#expose-code"
    },
    {
      "id": "technique:token-read",
      "type": "technique",
      "label": "Clone private repos with a stolen token",
      "url": "/attack-paths#technique-token-read"
    },
    {
      "id": "technique:visibility-flip",
      "type": "technique",
      "label": "Flip private repos to public",
      "url": "/attack-paths#technique-visibility-flip"
    },
    {
      "id": "technique:agent-leak",
      "type": "technique",
      "label": "Get an agent to copy private code into public",
      "url": "/attack-paths#technique-agent-leak"
    },
    {
      "id": "objective:persist",
      "type": "objective",
      "label": "Keep access",
      "url": "/attack-paths#persist"
    },
    {
      "id": "technique:add-collaborator",
      "type": "technique",
      "label": "Add a guest collaborator or new app",
      "url": "/attack-paths#technique-add-collaborator"
    },
    {
      "id": "technique:register-runner",
      "type": "technique",
      "label": "Register the attacker's machine as a runner",
      "url": "/attack-paths#technique-register-runner"
    },
    {
      "id": "technique:dormant-workflow",
      "type": "technique",
      "label": "Leave a dormant workflow behind",
      "url": "/attack-paths#technique-dormant-workflow"
    },
    {
      "id": "objective:platform",
      "type": "objective",
      "label": "Take over the GHES appliance",
      "url": "/attack-paths#platform"
    },
    {
      "id": "technique:auth-bypass",
      "type": "technique",
      "label": "Forge a login",
      "url": "/attack-paths#technique-auth-bypass"
    },
    {
      "id": "technique:admin-to-root",
      "type": "technique",
      "label": "Escalate from a GHES role to root",
      "url": "/attack-paths#technique-admin-to-root"
    },
    {
      "id": "vector:insider-write",
      "type": "entry-vector",
      "label": "Member with write access",
      "url": "/attack-paths#insider-write"
    },
    {
      "id": "vector:insider-admin",
      "type": "entry-vector",
      "label": "Repository admin or org owner",
      "url": "/attack-paths#insider-admin"
    },
    {
      "id": "vector:leaked-token",
      "type": "entry-vector",
      "label": "Leaked token",
      "url": "/attack-paths#leaked-token"
    },
    {
      "id": "vector:account-takeover",
      "type": "entry-vector",
      "label": "Phished or hijacked account",
      "url": "/attack-paths#account-takeover"
    },
    {
      "id": "vector:third-party-app",
      "type": "entry-vector",
      "label": "Compromised GitHub App or OAuth integration",
      "url": "/attack-paths#third-party-app"
    },
    {
      "id": "vector:ssh-key",
      "type": "entry-vector",
      "label": "Stolen SSH or deploy key",
      "url": "/attack-paths#ssh-key"
    },
    {
      "id": "vector:untrusted-input",
      "type": "entry-vector",
      "label": "Untrusted input reaches a privileged workflow",
      "url": "/attack-paths#untrusted-input"
    },
    {
      "id": "vector:upstream-dependency",
      "type": "entry-vector",
      "label": "Compromised Action or package",
      "url": "/attack-paths#upstream-dependency"
    },
    {
      "id": "vector:dev-tooling",
      "type": "entry-vector",
      "label": "Compromised developer tool or extension",
      "url": "/attack-paths#dev-tooling"
    },
    {
      "id": "vector:ai-agent",
      "type": "entry-vector",
      "label": "Prompt injection into an AI agent",
      "url": "/attack-paths#ai-agent"
    },
    {
      "id": "vector:platform-vuln",
      "type": "entry-vector",
      "label": "Vulnerability in GitHub Enterprise Server",
      "url": "/attack-paths#platform-vuln"
    },
    {
      "id": "incident:user-dependabot-impersonation",
      "type": "incident",
      "label": "Dependabot impersonation",
      "url": "/scenarios/dependabot-impersonation"
    },
    {
      "id": "incident:user-mercedes-benz-token-leak",
      "type": "incident",
      "label": "Mercedes-Benz source code exposure",
      "url": "/scenarios/mercedes-benz-token-leak"
    },
    {
      "id": "incident:user-oauth-consent-phishing",
      "type": "incident",
      "label": "OAuth consent phishing at scale",
      "url": "/scenarios/oauth-consent-phishing"
    },
    {
      "id": "incident:user-circleci-session-theft",
      "type": "incident",
      "label": "CircleCI session-cookie theft",
      "url": "/scenarios/circleci-session-theft"
    },
    {
      "id": "incident:user-nx-console-github-breach",
      "type": "incident",
      "label": "GitHub's internal repositories taken through a VS Code extension",
      "url": "/scenarios/nx-console-github-breach"
    },
    {
      "id": "incident:user-glassworm",
      "type": "incident",
      "label": "GlassWorm: editor extensions that steal GitHub tokens and force-push",
      "url": "/scenarios/glassworm"
    },
    {
      "id": "incident:app-heroku-travisci-oauth-theft",
      "type": "incident",
      "label": "Heroku / Travis CI OAuth token theft",
      "url": "/scenarios/heroku-travisci-oauth-theft"
    },
    {
      "id": "incident:app-tj-actions-changed-files",
      "type": "incident",
      "label": "tj-actions/changed-files supply-chain compromise (CVE-2025-30066)",
      "url": "/scenarios/tj-actions-changed-files"
    },
    {
      "id": "incident:app-artipacked",
      "type": "incident",
      "label": "ArtiPACKED artifact token leakage",
      "url": "/scenarios/artipacked"
    },
    {
      "id": "incident:app-agentic-mcp-tokens",
      "type": "incident",
      "label": "GitHub MCP / agentic token breadth",
      "url": "/scenarios/agentic-mcp-tokens"
    },
    {
      "id": "incident:app-installation-token-abuse",
      "type": "incident",
      "label": "GitHub App installation token abuse",
      "url": "/scenarios/installation-token-abuse"
    },
    {
      "id": "incident:org-pwn-requests",
      "type": "incident",
      "label": "\"Pwn requests\": pull_request_target & workflow_run",
      "url": "/scenarios/pwn-requests"
    },
    {
      "id": "incident:org-ultralytics",
      "type": "incident",
      "label": "Ultralytics build cache poisoning",
      "url": "/scenarios/ultralytics"
    },
    {
      "id": "incident:org-nx-s1ngularity",
      "type": "incident",
      "label": "Nx \"s1ngularity\"",
      "url": "/scenarios/nx-s1ngularity"
    },
    {
      "id": "incident:org-self-hosted-runner-attacks",
      "type": "incident",
      "label": "Self-hosted runner takeovers (PyTorch and others)",
      "url": "/scenarios/self-hosted-runner-attacks"
    },
    {
      "id": "incident:org-ghostaction",
      "type": "incident",
      "label": "GhostAction",
      "url": "/scenarios/ghostaction"
    },
    {
      "id": "incident:org-toptal",
      "type": "incident",
      "label": "Toptal repo-visibility flip and wiper",
      "url": "/scenarios/toptal"
    },
    {
      "id": "incident:org-salesloft-drift",
      "type": "incident",
      "label": "Salesloft Drift GitHub → AWS pivot",
      "url": "/scenarios/salesloft-drift"
    },
    {
      "id": "incident:org-shai-hulud",
      "type": "incident",
      "label": "Shai-Hulud self-propagating worm (1.0 & 2.0)",
      "url": "/scenarios/shai-hulud"
    },
    {
      "id": "incident:org-hackerbot-claw",
      "type": "incident",
      "label": "hackerbot-claw autonomous agent RCE",
      "url": "/scenarios/hackerbot-claw"
    },
    {
      "id": "incident:org-teampcp",
      "type": "incident",
      "label": "TeamPCP tag force-overwrite campaign",
      "url": "/scenarios/teampcp"
    },
    {
      "id": "incident:org-cache-poisoning",
      "type": "incident",
      "label": "Actions cache poisoning (Angular, TanStack)",
      "url": "/scenarios/cache-poisoning"
    },
    {
      "id": "incident:org-prt-scan",
      "type": "incident",
      "label": "prt-scan: automated pull_request_target attacks",
      "url": "/scenarios/prt-scan"
    },
    {
      "id": "incident:org-megalodon",
      "type": "incident",
      "label": "Megalodon: mass backdooring of CI workflows",
      "url": "/scenarios/megalodon"
    },
    {
      "id": "incident:org-chaindrop",
      "type": "incident",
      "label": "ChainDrop: a hijacked maintainer account publishes through trusted publishing",
      "url": "/scenarios/chaindrop"
    },
    {
      "id": "incident:ent-cve-2024-4985",
      "type": "incident",
      "label": "CVE-2024-4985: SAML auth bypass",
      "url": "/scenarios/cve-2024-4985"
    },
    {
      "id": "incident:ent-cve-2025-11578",
      "type": "incident",
      "label": "CVE-2025-11578: pre-receive hook symlink escape",
      "url": "/scenarios/cve-2025-11578"
    },
    {
      "id": "incident:ent-cve-2025-3509",
      "type": "incident",
      "label": "CVE-2025-3509: pre-receive hook RCE via port reuse",
      "url": "/scenarios/cve-2025-3509"
    },
    {
      "id": "incident:ent-cve-2026-3854",
      "type": "incident",
      "label": "CVE-2026-3854: push-option metadata RCE",
      "url": "/scenarios/cve-2026-3854"
    },
    {
      "id": "incident:ent-cve-2024-1374",
      "type": "incident",
      "label": "CVE-2024-1374: Management Console template injection",
      "url": "/scenarios/cve-2024-1374"
    },
    {
      "id": "incident:ent-cve-2022-23732",
      "type": "incident",
      "label": "CVE-2022-23732: Management Console path traversal / CSRF bypass",
      "url": "/scenarios/cve-2022-23732"
    },
    {
      "id": "checklist:auth-mfa-org",
      "type": "checklist-item",
      "label": "Enforce MFA for every member (prefer hardware/FIDO2 keys over SMS or app codes)",
      "url": "/checklist#auth-mfa-org"
    },
    {
      "id": "checklist:auth-disable-password-git",
      "type": "checklist-item",
      "label": "Disable password-based Git authentication (Enterprise Server only)",
      "url": "/checklist#auth-disable-password-git"
    },
    {
      "id": "checklist:auth-pat-expiry-policy",
      "type": "checklist-item",
      "label": "Set an organization-wide maximum PAT lifetime (90 days is a reasonable default)",
      "url": "/checklist#auth-pat-expiry-policy"
    },
    {
      "id": "checklist:auth-mfa-bots",
      "type": "checklist-item",
      "label": "Require MFA on bot/service accounts, not just human ones",
      "url": "/checklist#auth-mfa-bots"
    },
    {
      "id": "checklist:auth-audit-stale-creds",
      "type": "checklist-item",
      "label": "Audit and revoke stale PATs, unused SSH keys, and inactive accounts",
      "url": "/checklist#auth-audit-stale-creds"
    },
    {
      "id": "checklist:auth-disable-classic-pats",
      "type": "checklist-item",
      "label": "Disable classic PATs organization-wide, forcing migration to fine-grained PATs",
      "url": "/checklist#auth-disable-classic-pats"
    },
    {
      "id": "checklist:auth-saml-sso",
      "type": "checklist-item",
      "label": "Migrate to SAML SSO / Enterprise Managed Users for centralized identity control",
      "url": "/checklist#auth-saml-sso"
    },
    {
      "id": "checklist:auth-idp-group-teams",
      "type": "checklist-item",
      "label": "Manage team membership from identity provider groups instead of by hand",
      "url": "/checklist#auth-idp-group-teams"
    },
    {
      "id": "checklist:org-base-permission-read",
      "type": "checklist-item",
      "label": "Set the organization's base repository permission to None or Read, not Write or Admin",
      "url": "/checklist#org-base-permission-read"
    },
    {
      "id": "checklist:org-limit-owners",
      "type": "checklist-item",
      "label": "Limit the number of organization owners to the minimum needed",
      "url": "/checklist#org-limit-owners"
    },
    {
      "id": "checklist:org-restrict-member-privileges",
      "type": "checklist-item",
      "label": "Restrict public repo creation, visibility changes, repo deletion, private forks and outside collaborator invites to owners",
      "url": "/checklist#org-restrict-member-privileges"
    },
    {
      "id": "checklist:org-custom-roles",
      "type": "checklist-item",
      "label": "Use custom organization and repository roles instead of handing out Owner or Admin",
      "url": "/checklist#org-custom-roles"
    },
    {
      "id": "checklist:org-access-review",
      "type": "checklist-item",
      "label": "Run a quarterly access review of owners, repo admins, team membership and outside collaborators",
      "url": "/checklist#org-access-review"
    },
    {
      "id": "checklist:org-custom-properties",
      "type": "checklist-item",
      "label": "Classify repos with custom properties (data classification, criticality, compliance scope)",
      "url": "/checklist#org-custom-properties"
    },
    {
      "id": "checklist:org-review-installed-apps",
      "type": "checklist-item",
      "label": "Review every currently installed GitHub App / OAuth App and its granted scope",
      "url": "/checklist#org-review-installed-apps"
    },
    {
      "id": "checklist:org-approval-for-new-apps",
      "type": "checklist-item",
      "label": "Keep OAuth app access restrictions on and require security/IT approval for new apps",
      "url": "/checklist#org-approval-for-new-apps"
    },
    {
      "id": "checklist:org-audit-log-siem",
      "type": "checklist-item",
      "label": "Enable audit logging and export it to a SIEM for retention and detection",
      "url": "/checklist#org-audit-log-siem"
    },
    {
      "id": "checklist:org-ip-allowlist",
      "type": "checklist-item",
      "label": "Enforce an IP allow list for Git and web UI access from trusted ranges",
      "url": "/checklist#org-ip-allowlist"
    },
    {
      "id": "checklist:org-allowed-apps-doc",
      "type": "checklist-item",
      "label": "Maintain a documented list of allowed apps, their use case, and their owner",
      "url": "/checklist#org-allowed-apps-doc"
    },
    {
      "id": "checklist:org-agent-mcp-controls",
      "type": "checklist-item",
      "label": "Decide which AI coding agents and MCP servers may work on the organization's repositories",
      "url": "/checklist#org-agent-mcp-controls"
    },
    {
      "id": "checklist:org-backup-restore",
      "type": "checklist-item",
      "label": "Back up repositories and metadata outside GitHub, and rehearse a restore",
      "url": "/checklist#org-backup-restore"
    },
    {
      "id": "checklist:repo-branch-protection",
      "type": "checklist-item",
      "label": "Branch protection on default/release branches: required reviews + required status checks",
      "url": "/checklist#repo-branch-protection"
    },
    {
      "id": "checklist:repo-secret-scanning",
      "type": "checklist-item",
      "label": "Secret scanning and push protection enabled",
      "url": "/checklist#repo-secret-scanning"
    },
    {
      "id": "checklist:repo-dependabot",
      "type": "checklist-item",
      "label": "Dependency graph, Dependabot alerts and Dependabot security updates enabled",
      "url": "/checklist#repo-dependabot"
    },
    {
      "id": "checklist:repo-prevent-branch-deletion",
      "type": "checklist-item",
      "label": "Deletion and force-pushes prevented on critical branches",
      "url": "/checklist#repo-prevent-branch-deletion"
    },
    {
      "id": "checklist:repo-security-md",
      "type": "checklist-item",
      "label": "Add a .github/SECURITY.md with a disclosure contact and process",
      "url": "/checklist#repo-security-md"
    },
    {
      "id": "checklist:repo-codeowners",
      "type": "checklist-item",
      "label": "CODEOWNERS in place, required on sensitive paths",
      "url": "/checklist#repo-codeowners"
    },
    {
      "id": "checklist:repo-rulesets",
      "type": "checklist-item",
      "label": "Rulesets applied: push restriction, tag protection, sensitive file-path protection",
      "url": "/checklist#repo-rulesets"
    },
    {
      "id": "checklist:repo-signed-commits",
      "type": "checklist-item",
      "label": "Require signed commits on the default branch of sensitive repos",
      "url": "/checklist#repo-signed-commits"
    },
    {
      "id": "checklist:repo-artifact-attestation",
      "type": "checklist-item",
      "label": "Adopt artifact attestations for build provenance on published binaries/images",
      "url": "/checklist#repo-artifact-attestation"
    },
    {
      "id": "checklist:repo-immutable-releases",
      "type": "checklist-item",
      "label": "Make releases immutable, or protect release tags with a tag ruleset",
      "url": "/checklist#repo-immutable-releases"
    },
    {
      "id": "checklist:cicd-default-permissions-read",
      "type": "checklist-item",
      "label": "Set the default GITHUB_TOKEN permission to read-only at the org level",
      "url": "/checklist#cicd-default-permissions-read"
    },
    {
      "id": "checklist:cicd-no-actions-pr-approval",
      "type": "checklist-item",
      "label": "Turn off \"Allow GitHub Actions to create and approve pull requests\"",
      "url": "/checklist#cicd-no-actions-pr-approval"
    },
    {
      "id": "checklist:cicd-fork-approval",
      "type": "checklist-item",
      "label": "Require approval for first-time/external contributor workflow runs on forks",
      "url": "/checklist#cicd-fork-approval"
    },
    {
      "id": "checklist:cicd-no-selfhosted-public",
      "type": "checklist-item",
      "label": "Disallow self-hosted runners on public repositories",
      "url": "/checklist#cicd-no-selfhosted-public"
    },
    {
      "id": "checklist:cicd-secret-inventory",
      "type": "checklist-item",
      "label": "Inventory every Actions secret and its visibility/scope; the results are usually surprising",
      "url": "/checklist#cicd-secret-inventory"
    },
    {
      "id": "checklist:cicd-pin-actions-sha",
      "type": "checklist-item",
      "label": "Third-party Actions pinned to a full commit SHA instead of a mutable tag or branch",
      "url": "/checklist#cicd-pin-actions-sha"
    },
    {
      "id": "checklist:cicd-audit-pull-request-target",
      "type": "checklist-item",
      "label": "Audit every use of pull_request_target and remove or restructure risky ones",
      "url": "/checklist#cicd-audit-pull-request-target"
    },
    {
      "id": "checklist:cicd-verified-actions-only",
      "type": "checklist-item",
      "label": "Restrict which Actions can run to GitHub-verified creators or an internal allow-list",
      "url": "/checklist#cicd-verified-actions-only"
    },
    {
      "id": "checklist:cicd-rotation-runbook",
      "type": "checklist-item",
      "label": "Write and rehearse a credential-rotation runbook before you need it",
      "url": "/checklist#cicd-rotation-runbook"
    },
    {
      "id": "checklist:cicd-oidc-federation",
      "type": "checklist-item",
      "label": "Cloud credentials migrated from static keys to OIDC federation, scoped to repo + branch",
      "url": "/checklist#cicd-oidc-federation"
    },
    {
      "id": "checklist:cicd-github-apps-over-pats",
      "type": "checklist-item",
      "label": "Service-account automation migrated from PATs to GitHub Apps",
      "url": "/checklist#cicd-github-apps-over-pats"
    },
    {
      "id": "checklist:cicd-persist-credentials",
      "type": "checklist-item",
      "label": "Set `persist-credentials: false` on actions/checkout wherever later steps do not push",
      "url": "/checklist#cicd-persist-credentials"
    },
    {
      "id": "checklist:cicd-environment-reviewers",
      "type": "checklist-item",
      "label": "Put production secrets in environments with required reviewers",
      "url": "/checklist#cicd-environment-reviewers"
    },
    {
      "id": "checklist:cicd-runner-groups-selected",
      "type": "checklist-item",
      "label": "Limit each self-hosted runner group to the repositories that need it",
      "url": "/checklist#cicd-runner-groups-selected"
    },
    {
      "id": "checklist:cicd-release-cache-isolation",
      "type": "checklist-item",
      "label": "Do not restore Actions caches in release and publish workflows",
      "url": "/checklist#cicd-release-cache-isolation"
    },
    {
      "id": "checklist:cicd-trusted-publishing",
      "type": "checklist-item",
      "label": "Publish packages with trusted publishing (OIDC) instead of long-lived registry tokens",
      "url": "/checklist#cicd-trusted-publishing"
    },
    {
      "id": "escalation:workflow-to-secrets",
      "type": "escalation",
      "label": "Change a workflow, get its secrets",
      "url": "/attack-paths#escalation-workflow-to-secrets"
    },
    {
      "id": "escalation:tags-to-downstream",
      "type": "escalation",
      "label": "Move release tags on a widely used Action",
      "url": "/attack-paths#escalation-tags-to-downstream"
    },
    {
      "id": "escalation:dispatch-to-publish",
      "type": "escalation",
      "label": "Start a privileged publish job by hand",
      "url": "/attack-paths#escalation-dispatch-to-publish"
    },
    {
      "id": "escalation:admin-to-public",
      "type": "escalation",
      "label": "Flip private repositories to public",
      "url": "/attack-paths#escalation-admin-to-public"
    },
    {
      "id": "escalation:admin-to-runner",
      "type": "escalation",
      "label": "Register a self-hosted runner",
      "url": "/attack-paths#escalation-admin-to-runner"
    },
    {
      "id": "escalation:members-to-collaborator",
      "type": "escalation",
      "label": "Add a collaborator or guest that outlives the attack",
      "url": "/attack-paths#escalation-members-to-collaborator"
    },
    {
      "id": "escalation:team-maintainer-to-repos",
      "type": "escalation",
      "label": "Add yourself to a team with repository access",
      "url": "/attack-paths#escalation-team-maintainer-to-repos"
    },
    {
      "id": "escalation:shared-workflow-to-consumers",
      "type": "escalation",
      "label": "Change a shared reusable workflow",
      "url": "/attack-paths#escalation-shared-workflow-to-consumers"
    },
    {
      "id": "escalation:secret-scanning-harvest",
      "type": "escalation",
      "label": "Harvest leaked secrets from scanning alerts",
      "url": "/attack-paths#escalation-secret-scanning-harvest"
    },
    {
      "id": "escalation:enterprise-owner-joins-org",
      "type": "escalation",
      "label": "Join any organization as an enterprise owner",
      "url": "/attack-paths#escalation-enterprise-owner-joins-org"
    },
    {
      "id": "escalation:repojacking-action",
      "type": "escalation",
      "label": "Claim the old name of a renamed Action",
      "url": "/attack-paths#escalation-repojacking-action"
    },
    {
      "id": "escalation:runner-code-to-token",
      "type": "escalation",
      "label": "Take the workflow token from a runner",
      "url": "/attack-paths#escalation-runner-code-to-token"
    },
    {
      "id": "escalation:fork-pr-to-cache",
      "type": "escalation",
      "label": "Poison a cache the release build restores",
      "url": "/attack-paths#escalation-fork-pr-to-cache"
    },
    {
      "id": "escalation:fork-pr-to-runner",
      "type": "escalation",
      "label": "Persist on a non-ephemeral self-hosted runner",
      "url": "/attack-paths#escalation-fork-pr-to-runner"
    }
  ],
  "edges": [
    {
      "from": "role:repo-read",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:repo-read",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:repo-read",
      "to": "permission:codespaces:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:repo-read",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:repo-read",
      "to": "permission:discussions:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:repo-read",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:repo-read",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:repo-read",
      "to": "permission:pull_requests:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:repo-read",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:codespaces:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:repo-triage",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:repo-triage",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:repo-write",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:administration:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:pages:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:repo-maintain",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:administration:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:repository_custom_properties:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:repository_hooks:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:secret_scanning_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:pages:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:repository_advisories:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:repo-admin",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:personal-repo-collaborator",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:personal-repo-collaborator",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:personal-repo-collaborator",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:personal-repo-collaborator",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:personal-repo-collaborator",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:members:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_administration:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:administration:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:installation_repositories:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_custom_org_roles:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_custom_properties:admin",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_custom_roles:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_hooks:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_personal_access_token_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:repository_custom_properties:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:repository_hooks:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:secret_scanning_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_code_scanning_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_dependabot_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_secret_scanning_bypass_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:pages:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:repository_advisories:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:repository_creation:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:secret_scanning_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:members:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:organization_user_blocking:write",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-owner",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-member",
      "to": "permission:repository_creation:write",
      "type": "includes"
    },
    {
      "from": "role:org-member",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-member",
      "to": "permission:members:read",
      "type": "includes"
    },
    {
      "from": "role:org-member",
      "to": "permission:members:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-moderator",
      "to": "permission:repository_creation:write",
      "type": "includes"
    },
    {
      "from": "role:org-moderator",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-moderator",
      "to": "permission:members:read",
      "type": "includes"
    },
    {
      "from": "role:org-moderator",
      "to": "permission:members:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-moderator",
      "to": "permission:organization_administration:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-moderator",
      "to": "permission:organization_user_blocking:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:organization_administration:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:secret_scanning_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:administration:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:organization_code_scanning_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:organization_dependabot_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:organization_secret_scanning_bypass_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:repository_creation:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:secret_scanning_dismissal_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:members:read",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:members:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-security-manager",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-app-manager",
      "to": "permission:repository_creation:write",
      "type": "includes"
    },
    {
      "from": "role:org-app-manager",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-app-manager",
      "to": "permission:members:read",
      "type": "includes"
    },
    {
      "from": "role:org-app-manager",
      "to": "permission:members:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-cicd-admin",
      "to": "permission:organization_administration:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-cicd-admin",
      "to": "permission:organization_network_configurations:write",
      "type": "includes"
    },
    {
      "from": "role:org-cicd-admin",
      "to": "permission:organization_secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-cicd-admin",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "includes"
    },
    {
      "from": "role:org-cicd-admin",
      "to": "permission:organization_actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:codespaces:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:discussions:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:issues:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:pull_requests:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-all-repo-read",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:codespaces:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-triage",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-write",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:administration:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:pages:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-maintain",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:actions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:administration:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:packages:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:repository_custom_properties:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:repository_hooks:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:secret_scanning_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:secrets:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:workflows:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:actions_variables:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:checks:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:codespaces:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:contents:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:discussions:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:issues:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:pages:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:pull_requests:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:repository_advisories:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:statuses:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:actions:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:administration:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:packages:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:security_events:read",
      "type": "includes"
    },
    {
      "from": "role:org-all-repo-admin",
      "to": "permission:vulnerability_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:team-maintainer",
      "to": "permission:members:write",
      "type": "includes",
      "partial": true
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_custom_enterprise_roles:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_scim:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_teams:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_credentials:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_custom_properties:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_organization_installations:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-owner",
      "to": "permission:enterprise_billing:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-billing-manager",
      "to": "permission:enterprise_billing:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-billing-manager",
      "to": "permission:enterprise_licensing:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-security-manager",
      "to": "permission:secret_scanning_alerts:read",
      "type": "includes"
    },
    {
      "from": "role:enterprise-security-manager",
      "to": "permission:secret_scanning_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-security-manager",
      "to": "permission:security_events:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-security-manager",
      "to": "permission:vulnerability_alerts:write",
      "type": "includes"
    },
    {
      "from": "role:enterprise-security-manager",
      "to": "permission:contents:read",
      "type": "includes"
    },
    {
      "from": "scope:(no scope)",
      "to": "permission:metadata:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_administration:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:actions:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:administration:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:environments:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repository_hooks:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secret_scanning_alerts:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:workflows:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:actions_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:agent_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:agent_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:codespaces_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:contents:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:dependabot_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:deployments:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_actions_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_agent_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_agent_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_code_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_dependabot_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_secret_scanning_bypass_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:pages:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repo_secret_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repository_advisories:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repository_creation:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secret_scanning_alerts:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secret_scanning_bypass_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secret_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:security_events:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:statuses:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:vulnerability_alerts:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:actions_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:actions:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:agent_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:agent_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:checks:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:code_quality:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:contents:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:copilot_agent_settings:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:dependabot_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:environments:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:members:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:metadata:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_actions_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_agent_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_agent_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_campaigns:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_campaigns:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_code_scanning_dismissal_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_custom_roles:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_dependabot_dismissal_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_secret_scanning_bypass_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:organization_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:pages:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repository_advisories:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:repository_hooks:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secret_scanning_bypass_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:security_events:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo",
      "to": "permission:vulnerability_alerts:read",
      "type": "reaches"
    },
    {
      "from": "scope:repo:status",
      "to": "permission:statuses:write",
      "type": "reaches"
    },
    {
      "from": "scope:repo_deployment",
      "to": "permission:deployments:write",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:contents:write",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:deployments:write",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:repository_creation:write",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:statuses:write",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:public_repo",
      "to": "permission:contents:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:secret_scanning_alerts:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_code_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_dependabot_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_secret_scanning_bypass_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:repo_secret_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:secret_scanning_alerts:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:secret_scanning_bypass_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:secret_scanning_dismissal_requests:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:security_events:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:vulnerability_alerts:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:contents:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_campaigns:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_campaigns:write",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_code_scanning_dismissal_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_dependabot_dismissal_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:organization_secret_scanning_bypass_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:secret_scanning_bypass_requests:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:security_events:read",
      "type": "reaches"
    },
    {
      "from": "scope:security_events",
      "to": "permission:vulnerability_alerts:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:repo_hook",
      "to": "permission:repository_hooks:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:repo_hook",
      "to": "permission:repository_hooks:read",
      "type": "reaches"
    },
    {
      "from": "scope:write:repo_hook",
      "to": "permission:repository_hooks:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:repo_hook",
      "to": "permission:repository_hooks:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:members:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_administration:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_custom_org_roles:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_custom_roles:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_private_registries:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:codespaces_lifecycle_admin:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:codespaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_actions_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_agent_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_agent_variables:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_codespaces_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_codespaces_settings:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_codespaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_agent_settings:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_spaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_dependabot_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:codespaces:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:issue_fields:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:issue_fields:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:issue_types:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:issue_types:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:members:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_actions_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_agent_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_agent_variables:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_codespaces_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_codespaces:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_agent_settings:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_metrics:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_seat_management:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_seat_management:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_copilot_spaces:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_custom_org_roles:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_custom_roles:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_dependabot_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_private_registries:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org",
      "to": "permission:organization_self_hosted_runners:read",
      "type": "reaches"
    },
    {
      "from": "scope:write:org",
      "to": "permission:organization_administration:write",
      "type": "reaches",
      "partial": true
    },
    {
      "from": "scope:write:org",
      "to": "permission:organization_copilot_spaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:write:org",
      "to": "permission:organization_administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:write:org",
      "to": "permission:organization_copilot_seat_management:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:organization_copilot_spaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:issue_fields:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:issue_types:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:members:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:organization_administration:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:organization_copilot_metrics:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:organization_copilot_seat_management:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:org",
      "to": "permission:organization_copilot_spaces:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:public_key",
      "to": "permission:keys:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:public_key",
      "to": "permission:keys:read",
      "type": "reaches"
    },
    {
      "from": "scope:write:public_key",
      "to": "permission:keys:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:public_key",
      "to": "permission:keys:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org_hook",
      "to": "permission:organization_hooks:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:org_hook",
      "to": "permission:organization_hooks:read",
      "type": "reaches"
    },
    {
      "from": "scope:gist",
      "to": "permission:gists:write",
      "type": "reaches"
    },
    {
      "from": "scope:user",
      "to": "permission:emails:write",
      "type": "reaches"
    },
    {
      "from": "scope:user",
      "to": "permission:emails:read",
      "type": "reaches"
    },
    {
      "from": "scope:user",
      "to": "permission:followers:write",
      "type": "reaches"
    },
    {
      "from": "scope:user",
      "to": "permission:profile:write",
      "type": "reaches"
    },
    {
      "from": "scope:user:email",
      "to": "permission:emails:read",
      "type": "reaches"
    },
    {
      "from": "scope:user:follow",
      "to": "permission:followers:write",
      "type": "reaches"
    },
    {
      "from": "scope:project",
      "to": "permission:organization_projects:read",
      "type": "reaches"
    },
    {
      "from": "scope:project",
      "to": "permission:organization_projects:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:project",
      "to": "permission:organization_projects:read",
      "type": "reaches"
    },
    {
      "from": "scope:delete_repo",
      "to": "permission:administration:write",
      "type": "reaches"
    },
    {
      "from": "scope:write:packages",
      "to": "permission:packages:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:packages",
      "to": "permission:packages:read",
      "type": "reaches"
    },
    {
      "from": "scope:delete:packages",
      "to": "permission:packages:write",
      "type": "reaches",
      "partial": true
    },
    {
      "from": "scope:admin:gpg_key",
      "to": "permission:gpg_keys:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:gpg_key",
      "to": "permission:gpg_keys:read",
      "type": "reaches"
    },
    {
      "from": "scope:write:gpg_key",
      "to": "permission:gpg_keys:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:gpg_key",
      "to": "permission:gpg_keys:read",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces_lifecycle_admin:write",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces_user_secrets:write",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces:write",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces_lifecycle_admin:read",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces_metadata:read",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces_user_secrets:read",
      "type": "reaches"
    },
    {
      "from": "scope:codespace",
      "to": "permission:codespaces:read",
      "type": "reaches"
    },
    {
      "from": "scope:workflow",
      "to": "permission:workflows:write",
      "type": "reaches"
    },
    {
      "from": "scope:workflow",
      "to": "permission:contents:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_custom_enterprise_roles:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_credentials:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_ai_controls:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_billing:write",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_ai_controls:read",
      "type": "reaches"
    },
    {
      "from": "scope:admin:enterprise",
      "to": "permission:enterprise_copilot_usage:read",
      "type": "reaches"
    },
    {
      "from": "scope:manage_runners:enterprise",
      "to": "permission:organization_self_hosted_runners:write",
      "type": "reaches"
    },
    {
      "from": "scope:manage_billing:enterprise",
      "to": "permission:enterprise_billing:write",
      "type": "reaches"
    },
    {
      "from": "scope:read:enterprise",
      "to": "permission:enterprise_copilot_usage:read",
      "type": "reaches"
    },
    {
      "from": "scope:read:audit_log",
      "to": "permission:organization_administration:read",
      "type": "reaches"
    },
    {
      "from": "technique:no-review",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:no-review",
      "type": "enables"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:no-review",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:no-review",
      "type": "mitigates"
    },
    {
      "from": "incident:user-dependabot-impersonation",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "incident:org-ghostaction",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "incident:app-installation-token-abuse",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "incident:org-megalodon",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "technique:no-review",
      "type": "used"
    },
    {
      "from": "technique:sock-puppet",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:sock-puppet",
      "type": "enables"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:sock-puppet",
      "type": "enables"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:sock-puppet",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-codeowners",
      "to": "technique:sock-puppet",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-access-review",
      "to": "technique:sock-puppet",
      "type": "mitigates"
    },
    {
      "from": "technique:robot-approval",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:robot-approval",
      "type": "enables"
    },
    {
      "from": "permission:workflows:write",
      "to": "technique:robot-approval",
      "type": "enables"
    },
    {
      "from": "checklist:cicd-default-permissions-read",
      "to": "technique:robot-approval",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:robot-approval",
      "type": "mitigates"
    },
    {
      "from": "incident:org-hackerbot-claw",
      "to": "technique:robot-approval",
      "type": "used"
    },
    {
      "from": "technique:stale-approval",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:stale-approval",
      "type": "enables"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:stale-approval",
      "type": "enables"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:stale-approval",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:stale-approval",
      "type": "mitigates"
    },
    {
      "from": "technique:last-push",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:last-push",
      "type": "enables"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:last-push",
      "type": "enables"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:last-push",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:last-push",
      "type": "mitigates"
    },
    {
      "from": "technique:unreviewable",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:unreviewable",
      "type": "enables"
    },
    {
      "from": "checklist:repo-codeowners",
      "to": "technique:unreviewable",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-dependabot",
      "to": "technique:unreviewable",
      "type": "mitigates"
    },
    {
      "from": "technique:other-account",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:other-account",
      "type": "enables"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:other-account",
      "type": "enables"
    },
    {
      "from": "checklist:auth-mfa-org",
      "to": "technique:other-account",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-signed-commits",
      "to": "technique:other-account",
      "type": "mitigates"
    },
    {
      "from": "incident:user-oauth-consent-phishing",
      "to": "technique:other-account",
      "type": "used"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "technique:other-account",
      "type": "used"
    },
    {
      "from": "technique:trick-reviewer",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:pull_requests:write",
      "to": "technique:trick-reviewer",
      "type": "enables"
    },
    {
      "from": "checklist:repo-codeowners",
      "to": "technique:trick-reviewer",
      "type": "mitigates"
    },
    {
      "from": "technique:admin-bypass",
      "to": "objective:submit-code",
      "type": "achieves"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:admin-bypass",
      "type": "enables"
    },
    {
      "from": "permission:organization_administration:write",
      "to": "technique:admin-bypass",
      "type": "enables"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:admin-bypass",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-limit-owners",
      "to": "technique:admin-bypass",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:admin-bypass",
      "type": "mitigates"
    },
    {
      "from": "technique:force-push",
      "to": "objective:delete-history",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:force-push",
      "type": "enables"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:force-push",
      "type": "enables"
    },
    {
      "from": "checklist:repo-prevent-branch-deletion",
      "to": "technique:force-push",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-signed-commits",
      "to": "technique:force-push",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:force-push",
      "type": "mitigates"
    },
    {
      "from": "incident:user-glassworm",
      "to": "technique:force-push",
      "type": "used"
    },
    {
      "from": "technique:delete-runs",
      "to": "objective:delete-history",
      "type": "achieves"
    },
    {
      "from": "permission:actions:write",
      "to": "technique:delete-runs",
      "type": "enables"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:delete-runs",
      "type": "enables"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:delete-runs",
      "type": "mitigates"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "technique:delete-runs",
      "type": "used"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "technique:delete-runs",
      "type": "used"
    },
    {
      "from": "technique:push-tag",
      "to": "objective:release-tag",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:push-tag",
      "type": "enables"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:push-tag",
      "type": "mitigates"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "technique:push-tag",
      "type": "used"
    },
    {
      "from": "technique:repoint-tags",
      "to": "objective:release-tag",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:repoint-tags",
      "type": "enables"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:repoint-tags",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-pin-actions-sha",
      "to": "technique:repoint-tags",
      "type": "mitigates"
    },
    {
      "from": "incident:app-tj-actions-changed-files",
      "to": "technique:repoint-tags",
      "type": "used"
    },
    {
      "from": "incident:org-teampcp",
      "to": "technique:repoint-tags",
      "type": "used"
    },
    {
      "from": "technique:inject-workflow",
      "to": "objective:steal-secrets",
      "type": "achieves"
    },
    {
      "from": "permission:workflows:write",
      "to": "technique:inject-workflow",
      "type": "enables"
    },
    {
      "from": "checklist:repo-codeowners",
      "to": "technique:inject-workflow",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:inject-workflow",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-secret-inventory",
      "to": "technique:inject-workflow",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-oidc-federation",
      "to": "technique:inject-workflow",
      "type": "mitigates"
    },
    {
      "from": "incident:user-dependabot-impersonation",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "incident:org-ghostaction",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "incident:org-megalodon",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "technique:inject-workflow",
      "type": "used"
    },
    {
      "from": "technique:pwn-request",
      "to": "objective:steal-secrets",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:pwn-request",
      "type": "enables"
    },
    {
      "from": "permission:id_token:write",
      "to": "technique:pwn-request",
      "type": "enables"
    },
    {
      "from": "checklist:cicd-audit-pull-request-target",
      "to": "technique:pwn-request",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-default-permissions-read",
      "to": "technique:pwn-request",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-fork-approval",
      "to": "technique:pwn-request",
      "type": "mitigates"
    },
    {
      "from": "incident:org-pwn-requests",
      "to": "technique:pwn-request",
      "type": "used"
    },
    {
      "from": "incident:org-ultralytics",
      "to": "technique:pwn-request",
      "type": "used"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "technique:pwn-request",
      "type": "used"
    },
    {
      "from": "incident:org-hackerbot-claw",
      "to": "technique:pwn-request",
      "type": "used"
    },
    {
      "from": "incident:org-prt-scan",
      "to": "technique:pwn-request",
      "type": "used"
    },
    {
      "from": "technique:runner-memory",
      "to": "objective:steal-secrets",
      "type": "achieves"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:runner-memory",
      "type": "enables"
    },
    {
      "from": "checklist:cicd-pin-actions-sha",
      "to": "technique:runner-memory",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-verified-actions-only",
      "to": "technique:runner-memory",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-default-permissions-read",
      "to": "technique:runner-memory",
      "type": "mitigates"
    },
    {
      "from": "incident:app-tj-actions-changed-files",
      "to": "technique:runner-memory",
      "type": "used"
    },
    {
      "from": "incident:app-artipacked",
      "to": "technique:runner-memory",
      "type": "used"
    },
    {
      "from": "incident:org-self-hosted-runner-attacks",
      "to": "technique:runner-memory",
      "type": "used"
    },
    {
      "from": "incident:org-cache-poisoning",
      "to": "technique:runner-memory",
      "type": "used"
    },
    {
      "from": "technique:session-theft",
      "to": "objective:steal-secrets",
      "type": "achieves"
    },
    {
      "from": "checklist:org-ip-allowlist",
      "to": "technique:session-theft",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-rotation-runbook",
      "to": "technique:session-theft",
      "type": "mitigates"
    },
    {
      "from": "incident:user-circleci-session-theft",
      "to": "technique:session-theft",
      "type": "used"
    },
    {
      "from": "technique:cache-poison",
      "to": "objective:poison-build",
      "type": "achieves"
    },
    {
      "from": "checklist:cicd-audit-pull-request-target",
      "to": "technique:cache-poison",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-artifact-attestation",
      "to": "technique:cache-poison",
      "type": "mitigates"
    },
    {
      "from": "incident:org-cache-poisoning",
      "to": "technique:cache-poison",
      "type": "used"
    },
    {
      "from": "incident:org-ultralytics",
      "to": "technique:cache-poison",
      "type": "used"
    },
    {
      "from": "technique:dispatch-publish",
      "to": "objective:poison-build",
      "type": "achieves"
    },
    {
      "from": "permission:actions:write",
      "to": "technique:dispatch-publish",
      "type": "enables"
    },
    {
      "from": "permission:contents:write",
      "to": "technique:dispatch-publish",
      "type": "enables"
    },
    {
      "from": "checklist:repo-rulesets",
      "to": "technique:dispatch-publish",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:dispatch-publish",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-default-permissions-read",
      "to": "technique:dispatch-publish",
      "type": "mitigates"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "technique:dispatch-publish",
      "type": "used"
    },
    {
      "from": "technique:runner-backdoor",
      "to": "objective:poison-build",
      "type": "achieves"
    },
    {
      "from": "checklist:cicd-no-selfhosted-public",
      "to": "technique:runner-backdoor",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-fork-approval",
      "to": "technique:runner-backdoor",
      "type": "mitigates"
    },
    {
      "from": "incident:org-self-hosted-runner-attacks",
      "to": "technique:runner-backdoor",
      "type": "used"
    },
    {
      "from": "technique:malicious-release",
      "to": "objective:poison-build",
      "type": "achieves"
    },
    {
      "from": "permission:packages:write",
      "to": "technique:malicious-release",
      "type": "enables"
    },
    {
      "from": "checklist:repo-artifact-attestation",
      "to": "technique:malicious-release",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-oidc-federation",
      "to": "technique:malicious-release",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-trusted-publishing",
      "to": "technique:malicious-release",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-environment-reviewers",
      "to": "technique:malicious-release",
      "type": "mitigates"
    },
    {
      "from": "checklist:cicd-rotation-runbook",
      "to": "technique:malicious-release",
      "type": "mitigates"
    },
    {
      "from": "incident:org-toptal",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "incident:org-teampcp",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "incident:org-megalodon",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "incident:user-glassworm",
      "to": "technique:malicious-release",
      "type": "used"
    },
    {
      "from": "technique:token-read",
      "to": "objective:expose-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:read",
      "to": "technique:token-read",
      "type": "enables"
    },
    {
      "from": "checklist:auth-pat-expiry-policy",
      "to": "technique:token-read",
      "type": "mitigates"
    },
    {
      "from": "checklist:auth-disable-classic-pats",
      "to": "technique:token-read",
      "type": "mitigates"
    },
    {
      "from": "checklist:auth-audit-stale-creds",
      "to": "technique:token-read",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-ip-allowlist",
      "to": "technique:token-read",
      "type": "mitigates"
    },
    {
      "from": "incident:user-mercedes-benz-token-leak",
      "to": "technique:token-read",
      "type": "used"
    },
    {
      "from": "incident:app-heroku-travisci-oauth-theft",
      "to": "technique:token-read",
      "type": "used"
    },
    {
      "from": "incident:user-oauth-consent-phishing",
      "to": "technique:token-read",
      "type": "used"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "technique:token-read",
      "type": "used"
    },
    {
      "from": "incident:user-nx-console-github-breach",
      "to": "technique:token-read",
      "type": "used"
    },
    {
      "from": "technique:visibility-flip",
      "to": "objective:expose-code",
      "type": "achieves"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:visibility-flip",
      "type": "enables"
    },
    {
      "from": "permission:organization_administration:write",
      "to": "technique:visibility-flip",
      "type": "enables"
    },
    {
      "from": "checklist:org-restrict-member-privileges",
      "to": "technique:visibility-flip",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-limit-owners",
      "to": "technique:visibility-flip",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:visibility-flip",
      "type": "mitigates"
    },
    {
      "from": "incident:org-toptal",
      "to": "technique:visibility-flip",
      "type": "used"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "technique:visibility-flip",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "technique:visibility-flip",
      "type": "used"
    },
    {
      "from": "technique:agent-leak",
      "to": "objective:expose-code",
      "type": "achieves"
    },
    {
      "from": "permission:contents:read",
      "to": "technique:agent-leak",
      "type": "enables"
    },
    {
      "from": "permission:issues:write",
      "to": "technique:agent-leak",
      "type": "enables"
    },
    {
      "from": "checklist:org-review-installed-apps",
      "to": "technique:agent-leak",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-approval-for-new-apps",
      "to": "technique:agent-leak",
      "type": "mitigates"
    },
    {
      "from": "incident:app-agentic-mcp-tokens",
      "to": "technique:agent-leak",
      "type": "used"
    },
    {
      "from": "technique:add-collaborator",
      "to": "objective:persist",
      "type": "achieves"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:add-collaborator",
      "type": "enables"
    },
    {
      "from": "permission:members:write",
      "to": "technique:add-collaborator",
      "type": "enables"
    },
    {
      "from": "permission:installation_repositories:write",
      "to": "technique:add-collaborator",
      "type": "enables"
    },
    {
      "from": "checklist:org-restrict-member-privileges",
      "to": "technique:add-collaborator",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-access-review",
      "to": "technique:add-collaborator",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-review-installed-apps",
      "to": "technique:add-collaborator",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-approval-for-new-apps",
      "to": "technique:add-collaborator",
      "type": "mitigates"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "technique:add-collaborator",
      "type": "used"
    },
    {
      "from": "incident:user-oauth-consent-phishing",
      "to": "technique:add-collaborator",
      "type": "used"
    },
    {
      "from": "technique:register-runner",
      "to": "objective:persist",
      "type": "achieves"
    },
    {
      "from": "permission:administration:write",
      "to": "technique:register-runner",
      "type": "enables"
    },
    {
      "from": "permission:organization_self_hosted_runners:write",
      "to": "technique:register-runner",
      "type": "enables"
    },
    {
      "from": "checklist:cicd-no-selfhosted-public",
      "to": "technique:register-runner",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:register-runner",
      "type": "mitigates"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "technique:register-runner",
      "type": "used"
    },
    {
      "from": "technique:dormant-workflow",
      "to": "objective:persist",
      "type": "achieves"
    },
    {
      "from": "permission:workflows:write",
      "to": "technique:dormant-workflow",
      "type": "enables"
    },
    {
      "from": "checklist:repo-codeowners",
      "to": "technique:dormant-workflow",
      "type": "mitigates"
    },
    {
      "from": "checklist:repo-branch-protection",
      "to": "technique:dormant-workflow",
      "type": "mitigates"
    },
    {
      "from": "checklist:org-audit-log-siem",
      "to": "technique:dormant-workflow",
      "type": "mitigates"
    },
    {
      "from": "incident:org-megalodon",
      "to": "technique:dormant-workflow",
      "type": "used"
    },
    {
      "from": "technique:auth-bypass",
      "to": "objective:platform",
      "type": "achieves"
    },
    {
      "from": "incident:ent-cve-2024-4985",
      "to": "technique:auth-bypass",
      "type": "used"
    },
    {
      "from": "technique:admin-to-root",
      "to": "objective:platform",
      "type": "achieves"
    },
    {
      "from": "checklist:org-limit-owners",
      "to": "technique:admin-to-root",
      "type": "mitigates"
    },
    {
      "from": "incident:ent-cve-2025-11578",
      "to": "technique:admin-to-root",
      "type": "used"
    },
    {
      "from": "incident:ent-cve-2025-3509",
      "to": "technique:admin-to-root",
      "type": "used"
    },
    {
      "from": "incident:ent-cve-2026-3854",
      "to": "technique:admin-to-root",
      "type": "used"
    },
    {
      "from": "incident:ent-cve-2024-1374",
      "to": "technique:admin-to-root",
      "type": "used"
    },
    {
      "from": "incident:ent-cve-2022-23732",
      "to": "technique:admin-to-root",
      "type": "used"
    },
    {
      "from": "vector:insider-write",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:insider-write",
      "to": "permission:pull_requests:write",
      "type": "uses"
    },
    {
      "from": "vector:insider-write",
      "to": "permission:workflows:write",
      "type": "uses"
    },
    {
      "from": "vector:insider-admin",
      "to": "permission:administration:write",
      "type": "uses"
    },
    {
      "from": "vector:insider-admin",
      "to": "permission:organization_administration:write",
      "type": "uses"
    },
    {
      "from": "vector:insider-admin",
      "to": "permission:members:write",
      "type": "uses"
    },
    {
      "from": "vector:leaked-token",
      "to": "permission:contents:read",
      "type": "uses"
    },
    {
      "from": "vector:leaked-token",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:leaked-token",
      "to": "permission:workflows:write",
      "type": "uses"
    },
    {
      "from": "vector:account-takeover",
      "to": "permission:members:write",
      "type": "uses"
    },
    {
      "from": "vector:account-takeover",
      "to": "permission:keys:write",
      "type": "uses"
    },
    {
      "from": "vector:third-party-app",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:third-party-app",
      "to": "permission:workflows:write",
      "type": "uses"
    },
    {
      "from": "vector:third-party-app",
      "to": "permission:installation_repositories:write",
      "type": "uses"
    },
    {
      "from": "vector:ssh-key",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:ssh-key",
      "to": "permission:keys:write",
      "type": "uses"
    },
    {
      "from": "vector:untrusted-input",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:untrusted-input",
      "to": "permission:pull_requests:write",
      "type": "uses"
    },
    {
      "from": "vector:untrusted-input",
      "to": "permission:id_token:write",
      "type": "uses"
    },
    {
      "from": "vector:upstream-dependency",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:upstream-dependency",
      "to": "permission:packages:write",
      "type": "uses"
    },
    {
      "from": "vector:dev-tooling",
      "to": "permission:contents:read",
      "type": "uses"
    },
    {
      "from": "vector:dev-tooling",
      "to": "permission:contents:write",
      "type": "uses"
    },
    {
      "from": "vector:dev-tooling",
      "to": "permission:workflows:write",
      "type": "uses"
    },
    {
      "from": "vector:ai-agent",
      "to": "permission:issues:write",
      "type": "uses"
    },
    {
      "from": "vector:ai-agent",
      "to": "permission:contents:read",
      "type": "uses"
    },
    {
      "from": "vector:ai-agent",
      "to": "permission:pull_requests:write",
      "type": "uses"
    },
    {
      "from": "incident:user-dependabot-impersonation",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:user-dependabot-impersonation",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:user-mercedes-benz-token-leak",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:user-oauth-consent-phishing",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:user-oauth-consent-phishing",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:user-nx-console-github-breach",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:user-glassworm",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:app-heroku-travisci-oauth-theft",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:app-tj-actions-changed-files",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:app-artipacked",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:app-artipacked",
      "to": "permission:actions:read",
      "type": "abused"
    },
    {
      "from": "incident:app-agentic-mcp-tokens",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:app-agentic-mcp-tokens",
      "to": "permission:issues:write",
      "type": "abused"
    },
    {
      "from": "incident:app-agentic-mcp-tokens",
      "to": "permission:pull_requests:write",
      "type": "abused"
    },
    {
      "from": "incident:app-installation-token-abuse",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:app-installation-token-abuse",
      "to": "permission:pull_requests:write",
      "type": "abused"
    },
    {
      "from": "incident:org-pwn-requests",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-pwn-requests",
      "to": "permission:id_token:write",
      "type": "abused"
    },
    {
      "from": "incident:org-ultralytics",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "permission:actions:write",
      "type": "abused"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-self-hosted-runner-attacks",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-ghostaction",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:org-toptal",
      "to": "permission:organization_administration:write",
      "type": "abused"
    },
    {
      "from": "incident:org-toptal",
      "to": "permission:administration:write",
      "type": "abused"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "permission:administration:write",
      "type": "abused"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "permission:contents:read",
      "type": "abused"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "permission:administration:write",
      "type": "abused"
    },
    {
      "from": "incident:org-hackerbot-claw",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-teampcp",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-prt-scan",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-megalodon",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-megalodon",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "incident:org-chaindrop",
      "to": "permission:workflows:write",
      "type": "abused"
    },
    {
      "from": "incident:ent-cve-2026-3854",
      "to": "permission:contents:write",
      "type": "abused"
    },
    {
      "from": "permission:workflows:write",
      "to": "escalation:workflow-to-secrets",
      "type": "starts"
    },
    {
      "from": "escalation:workflow-to-secrets",
      "to": "permission:id_token:write",
      "type": "gains"
    },
    {
      "from": "incident:user-dependabot-impersonation",
      "to": "escalation:workflow-to-secrets",
      "type": "used"
    },
    {
      "from": "incident:org-ghostaction",
      "to": "escalation:workflow-to-secrets",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "escalation:workflow-to-secrets",
      "type": "used"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "escalation:workflow-to-secrets",
      "type": "used"
    },
    {
      "from": "permission:contents:write",
      "to": "escalation:tags-to-downstream",
      "type": "starts"
    },
    {
      "from": "incident:app-tj-actions-changed-files",
      "to": "escalation:tags-to-downstream",
      "type": "used"
    },
    {
      "from": "incident:org-teampcp",
      "to": "escalation:tags-to-downstream",
      "type": "used"
    },
    {
      "from": "permission:actions:write",
      "to": "escalation:dispatch-to-publish",
      "type": "starts"
    },
    {
      "from": "escalation:dispatch-to-publish",
      "to": "permission:packages:write",
      "type": "gains"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "escalation:dispatch-to-publish",
      "type": "used"
    },
    {
      "from": "permission:administration:write",
      "to": "escalation:admin-to-public",
      "type": "starts"
    },
    {
      "from": "permission:organization_administration:write",
      "to": "escalation:admin-to-public",
      "type": "starts"
    },
    {
      "from": "incident:org-toptal",
      "to": "escalation:admin-to-public",
      "type": "used"
    },
    {
      "from": "incident:org-nx-s1ngularity",
      "to": "escalation:admin-to-public",
      "type": "used"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "escalation:admin-to-public",
      "type": "used"
    },
    {
      "from": "permission:administration:write",
      "to": "escalation:admin-to-runner",
      "type": "starts"
    },
    {
      "from": "permission:organization_self_hosted_runners:write",
      "to": "escalation:admin-to-runner",
      "type": "starts"
    },
    {
      "from": "incident:org-shai-hulud",
      "to": "escalation:admin-to-runner",
      "type": "used"
    },
    {
      "from": "permission:members:write",
      "to": "escalation:members-to-collaborator",
      "type": "starts"
    },
    {
      "from": "permission:administration:write",
      "to": "escalation:members-to-collaborator",
      "type": "starts"
    },
    {
      "from": "escalation:members-to-collaborator",
      "to": "permission:contents:write",
      "type": "gains"
    },
    {
      "from": "incident:org-salesloft-drift",
      "to": "escalation:members-to-collaborator",
      "type": "used"
    },
    {
      "from": "escalation:team-maintainer-to-repos",
      "to": "permission:administration:write",
      "type": "gains"
    },
    {
      "from": "escalation:team-maintainer-to-repos",
      "to": "permission:workflows:write",
      "type": "gains"
    },
    {
      "from": "permission:contents:write",
      "to": "escalation:shared-workflow-to-consumers",
      "type": "starts"
    },
    {
      "from": "escalation:shared-workflow-to-consumers",
      "to": "permission:workflows:write",
      "type": "gains"
    },
    {
      "from": "permission:secret_scanning_alerts:read",
      "to": "escalation:secret-scanning-harvest",
      "type": "starts"
    },
    {
      "from": "escalation:enterprise-owner-joins-org",
      "to": "permission:organization_administration:write",
      "type": "gains"
    },
    {
      "from": "escalation:enterprise-owner-joins-org",
      "to": "permission:members:write",
      "type": "gains"
    },
    {
      "from": "escalation:repojacking-action",
      "to": "permission:workflows:write",
      "type": "gains"
    },
    {
      "from": "escalation:runner-code-to-token",
      "to": "permission:contents:write",
      "type": "gains"
    },
    {
      "from": "incident:app-tj-actions-changed-files",
      "to": "escalation:runner-code-to-token",
      "type": "used"
    },
    {
      "from": "incident:org-self-hosted-runner-attacks",
      "to": "escalation:runner-code-to-token",
      "type": "used"
    },
    {
      "from": "incident:app-artipacked",
      "to": "escalation:runner-code-to-token",
      "type": "used"
    },
    {
      "from": "escalation:fork-pr-to-cache",
      "to": "permission:packages:write",
      "type": "gains"
    },
    {
      "from": "incident:org-ultralytics",
      "to": "escalation:fork-pr-to-cache",
      "type": "used"
    },
    {
      "from": "incident:org-cache-poisoning",
      "to": "escalation:fork-pr-to-cache",
      "type": "used"
    },
    {
      "from": "escalation:fork-pr-to-runner",
      "to": "permission:contents:write",
      "type": "gains"
    },
    {
      "from": "incident:org-self-hosted-runner-attacks",
      "to": "escalation:fork-pr-to-runner",
      "type": "used"
    }
  ]
}