{
  "generatedAt": "2026-10-12T16:01:05.493Z",
  "rolesFetchedAt": "2026-10-11",
  "note": "Each role's tier is the highest tier among the permissions it includes (see permissions.json). A permission marked partial is only partly used by the role and counts with its own tier. customRolePermissions lists what GitHub lets you add to a custom repository or organization role (Enterprise Cloud), each mapped to permissions the same way.",
  "roles": [
    {
      "id": "repo-read",
      "name": "Read",
      "kind": "repository",
      "scope": "One repository",
      "summary": "View and discuss the project.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization",
      "tier": 3,
      "plane": "data",
      "why": "Tier 3 because nothing it includes goes beyond Tier 3.",
      "decidingPermissions": [
        "actions:read",
        "administration:read",
        "contents:read",
        "packages:read",
        "security_events:read",
        "codespaces:write",
        "discussions:write",
        "issues:write",
        "pull_requests:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for public repositories"
          ],
          "partial": {
            "tier": 3,
            "why": "A codespace with the person's own access and no repository secrets."
          }
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Create new discussions and comment on existing discussions"
          ],
          "partial": {
            "tier": 3,
            "why": "Posting, not moderating."
          }
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves"
          ],
          "partial": {
            "tier": 3,
            "why": "Opening and commenting on issues, not editing anyone else's."
          }
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "inferred",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests"
          ],
          "partial": {
            "tier": 3,
            "why": "Proposes changes; nothing lands without someone with write access."
          }
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization"
      }
    },
    {
      "id": "repo-triage",
      "name": "Triage",
      "kind": "repository",
      "scope": "One repository",
      "summary": "Manage issues, pull requests and discussions without write access to code.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization",
      "tier": 2,
      "plane": "data",
      "why": "Tier 2 because it includes Discussions: Write (repository), Issues: Write (repository), Pull requests: Write (repository).",
      "decidingPermissions": [
        "discussions:write",
        "issues:write",
        "pull_requests:write"
      ],
      "permissions": [
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Move a discussion to a different category",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Apply milestones",
            "Mark duplicate issues and pull requests"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Request pull request reviews"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for public repositories"
          ],
          "partial": {
            "tier": 3,
            "why": "A codespace with the person's own access and no repository secrets."
          }
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization"
      }
    },
    {
      "id": "repo-write",
      "name": "Write",
      "kind": "repository",
      "scope": "One repository",
      "summary": "Push code, run workflows and manage releases.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization",
      "tier": 1,
      "plane": "data",
      "why": "Tier 1 because it includes Actions: Write (repository), Packages: Write (repository), Secrets: Write (repository) and 1 more.",
      "decidingPermissions": [
        "actions:write",
        "packages:write",
        "secrets:write",
        "workflows:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages"
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization"
      }
    },
    {
      "id": "repo-maintain",
      "name": "Maintain",
      "kind": "repository",
      "scope": "One repository",
      "summary": "Manage the repository without sensitive or destructive settings.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization",
      "tier": 1,
      "plane": "management",
      "why": "Tier 1 because it includes Actions: Write (repository), Administration: Write (repository), Packages: Write (repository) and 2 more.",
      "decidingPermissions": [
        "actions:write",
        "administration:write",
        "packages:write",
        "secrets:write",
        "workflows:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "documented",
          "via": [
            "Edit a repository's description",
            "Manage topics",
            "Enable wikis and restrict wiki editors",
            "Configure pull request merges",
            "Create and edit repository social cards",
            "Limit interactions in a repository",
            "Enable GitHub Discussions in a repository"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages"
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Push to protected branches",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues"
          ]
        },
        {
          "permissionId": "pages:write",
          "source": "documented",
          "via": [
            "Configure a publishing source for GitHub Pages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        },
        {
          "action": "View content exclusion settings for GitHub Copilot",
          "note": "Viewing a setting."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization"
      }
    },
    {
      "id": "repo-admin",
      "name": "Admin",
      "kind": "repository",
      "scope": "One repository",
      "summary": "Full access to the repository, including security, access and destructive settings.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization",
      "tier": 1,
      "plane": "management",
      "why": "Tier 1 because it includes Actions: Write (repository), Administration: Write (repository), Packages: Write (repository) and 5 more.",
      "decidingPermissions": [
        "actions:write",
        "administration:write",
        "packages:write",
        "repository_custom_properties:write",
        "repository_hooks:write",
        "secrets:write",
        "workflows:write",
        "secret_scanning_alerts:read"
      ],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "documented",
          "via": [
            "Manage individual, team, and outside collaborator access to the repository",
            "Edit a repository's description",
            "Manage topics",
            "Enable wikis and restrict wiki editors",
            "Configure pull request merges",
            "Manage branch protection rules and repository rulesets",
            "Merge pull requests on protected branches, even if there are no approving reviews",
            "Create and edit repository social cards",
            "Limit interactions in a repository",
            "Add a repository to a team",
            "Manage outside collaborator access to a repository",
            "Change a repository's visibility",
            "Make a repository a template",
            "Change a repository's settings",
            "Manage team and collaborator access to the repository",
            "Edit the repository's default branch",
            "Rename the repository's default branch",
            "Manage webhooks and deploy keys",
            "Manage the forking policy for a repository",
            "Transfer repositories into the organization",
            "Delete or transfer repositories out of the organization",
            "Archive repositories",
            "Display a sponsor button",
            "Create autolink references to external resources, like Jira or Zendesk",
            "Enable GitHub Discussions in a repository",
            "Manage access to GitHub Advanced Security features",
            "Enable the dependency graph for a private repository"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages",
            "Delete and restore packages"
          ]
        },
        {
          "permissionId": "repository_custom_properties:write",
          "source": "documented",
          "via": [
            "Edit the custom property values for the repository"
          ]
        },
        {
          "permissionId": "repository_hooks:write",
          "source": "documented",
          "via": [
            "Manage webhooks and deploy keys"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:read",
          "source": "documented",
          "via": [
            "Unlike writers and maintainers, admins see every secret scanning alert in the repository, including the leaked values."
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Push to protected branches",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues",
            "Delete an issue"
          ]
        },
        {
          "permissionId": "pages:write",
          "source": "documented",
          "via": [
            "Configure a publishing source for GitHub Pages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "repository_advisories:write",
          "source": "documented",
          "via": [
            "Create security advisories"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        },
        {
          "action": "View content exclusion settings for GitHub Copilot",
          "note": "Viewing a setting."
        }
      ],
      "contextDependent": true,
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization"
      }
    },
    {
      "id": "personal-repo-collaborator",
      "name": "Collaborator on a personal repository",
      "kind": "repository",
      "scope": "One repository owned by a personal account",
      "summary": "Someone the owner of a personal repository has invited. There is only one level: collaborators can pull and push, manage issues and pull requests, and publish packages.",
      "docsUrl": "https://docs.github.com/en/account-and-profile/reference/permission-levels-for-a-personal-account-repository",
      "tier": 1,
      "plane": "data",
      "why": "Tier 1 because it includes Packages: Write (repository), Workflows: Write (repository).",
      "decidingPermissions": [
        "packages:write",
        "workflows:write"
      ],
      "permissions": [
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Collaborators on a personal repository can pull (read) the contents of the repository and push (write) changes to the repository, manage issues, labels and milestones, create, merge and close pull requests, and publish packages."
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Pushing includes files under .github/workflows; the docs give collaborators no lower level, and private repositories cannot grant read only."
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Collaborators on a personal repository can pull (read) the contents of the repository and push (write) changes to the repository, manage issues, labels and milestones, create, merge and close pull requests, and publish packages."
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Collaborators on a personal repository can pull (read) the contents of the repository and push (write) changes to the repository, manage issues, labels and milestones, create, merge and close pull requests, and publish packages."
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Collaborators on a personal repository can pull (read) the contents of the repository and push (write) changes to the repository, manage issues, labels and milestones, create, merge and close pull requests, and publish packages."
          ]
        }
      ],
      "uncovered": [],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "ghes"
        ],
        "source": "https://docs.github.com/en/account-and-profile/reference/permission-levels-for-a-personal-account-repository"
      }
    },
    {
      "id": "org-owner",
      "name": "Owner",
      "kind": "organization",
      "scope": "The organization and every repository in it",
      "summary": "Full administrative control of the organization.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 0,
      "plane": "control",
      "why": "Tier 0 because it includes Members: Write (organization), Administration: Write (organization).",
      "decidingPermissions": [
        "members:write",
        "organization_administration:write"
      ],
      "permissions": [
        {
          "permissionId": "members:write",
          "source": "documented",
          "via": [
            "Invite people to join the organization",
            "Edit and cancel invitations to join the organization",
            "Remove members from the organization",
            "Reinstate former members to the organization",
            "Add and remove people from all teams",
            "Promote organization members to team maintainer",
            "Configure code review assignments",
            "Delete all teams",
            "Create teams",
            "Move teams in an organization's hierarchy",
            "Convert organization members to outside collaborators",
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_administration:write",
          "source": "documented",
          "via": [
            "Edit the organization's profile page",
            "Delete the organization account, including all repositories",
            "Limit interactions for certain users in public repositories",
            "Manage the publication of GitHub Pages sites from repositories in the organization",
            "Manage security and analysis settings",
            "Manage the forking policy",
            "Limit activity in public repositories in an organization",
            "Manage the default branch name",
            "Manage default labels",
            "Manage pull request reviews in the organization",
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "documented",
          "via": [
            "Manage individual, team, and outside collaborator access to the repository",
            "Edit a repository's description",
            "Manage topics",
            "Enable wikis and restrict wiki editors",
            "Configure pull request merges",
            "Manage branch protection rules and repository rulesets",
            "Merge pull requests on protected branches, even if there are no approving reviews",
            "Create and edit repository social cards",
            "Limit interactions in a repository",
            "Add a repository to a team",
            "Manage outside collaborator access to a repository",
            "Change a repository's visibility",
            "Make a repository a template",
            "Change a repository's settings",
            "Manage team and collaborator access to the repository",
            "Edit the repository's default branch",
            "Rename the repository's default branch",
            "Manage webhooks and deploy keys",
            "Manage the forking policy for a repository",
            "Transfer repositories into the organization",
            "Delete or transfer repositories out of the organization",
            "Archive repositories",
            "Display a sponsor button",
            "Create autolink references to external resources, like Jira or Zendesk",
            "Enable GitHub Discussions in a repository",
            "Manage access to GitHub Advanced Security features",
            "Enable the dependency graph for a private repository",
            "Add collaborators to all repositories",
            "Transfer repositories",
            "Manage Dependabot security updates"
          ]
        },
        {
          "permissionId": "installation_repositories:write",
          "source": "inferred",
          "via": [
            "Purchase, install, manage billing for, and cancel GitHub Marketplace apps"
          ]
        },
        {
          "permissionId": "organization_custom_org_roles:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_custom_properties:admin",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_custom_roles:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_hooks:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_personal_access_token_requests:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_secrets:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "organization_self_hosted_runners:write",
          "source": "documented",
          "via": [
            "Owners have full administrative access to the organization: every setting, role, webhook, secret and runner."
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages",
            "Delete and restore packages"
          ]
        },
        {
          "permissionId": "repository_custom_properties:write",
          "source": "documented",
          "via": [
            "Edit the custom property values for the repository"
          ]
        },
        {
          "permissionId": "repository_hooks:write",
          "source": "documented",
          "via": [
            "Manage webhooks and deploy keys"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:read",
          "source": "documented",
          "via": [
            "Unlike writers and maintainers, admins see every secret scanning alert in the repository, including the leaked values."
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Push to protected branches",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch",
            "Push (write) and clone (copy) all repositories in the organization"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues",
            "Delete an issue",
            "Hide comments on writable commits, pull requests, and issues",
            "Hide comments on all commits, pull requests, and issues"
          ]
        },
        {
          "permissionId": "organization_code_scanning_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review and manage code scanning dismissal requests"
          ]
        },
        {
          "permissionId": "organization_dependabot_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review Dependabot alert dismissal requests",
            "Bypass Dependabot alert dismissal requests"
          ]
        },
        {
          "permissionId": "organization_secret_scanning_bypass_requests:write",
          "source": "documented",
          "via": [
            "Review and manage secret scanning bypass requests"
          ]
        },
        {
          "permissionId": "pages:write",
          "source": "documented",
          "via": [
            "Configure a publishing source for GitHub Pages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "repository_advisories:write",
          "source": "documented",
          "via": [
            "Create security advisories"
          ]
        },
        {
          "permissionId": "repository_creation:write",
          "source": "documented",
          "via": [
            "Create repositories"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "secret_scanning_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review and manage secret scanning dismissal requests"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository",
            "View people with access to an organization repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases",
            "Pull (read) all repositories in the organization"
          ]
        },
        {
          "permissionId": "members:read",
          "source": "documented",
          "via": [
            "See all organization members and teams"
          ]
        },
        {
          "permissionId": "organization_administration:read",
          "source": "documented",
          "via": [
            "Access the organization audit log"
          ]
        },
        {
          "permissionId": "organization_user_blocking:write",
          "source": "documented",
          "via": [
            "Block and unblock non-member contributors"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests",
            "View security overview for the organization"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository",
            "View security overview for the organization",
            "Receive Dependabot alerts about insecure dependencies for all of an organization's repositories"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        },
        {
          "action": "View content exclusion settings for GitHub Copilot",
          "note": "Viewing a setting."
        },
        {
          "action": "View and edit billing information",
          "note": "Billing only. No permission on the reference covers organization billing."
        },
        {
          "action": "Set scheduled reminders",
          "note": "Notifications only."
        },
        {
          "action": "@mention any visible team",
          "note": "Notifications only."
        },
        {
          "action": "Can be made a team maintainer",
          "note": "Eligibility, not a grant. See the Team maintainer role."
        },
        {
          "action": "Set a team profile picture in all teams",
          "note": "Cosmetic."
        },
        {
          "action": "Sponsor accounts and manage the organization's sponsorships",
          "note": "Sponsorships and payments only."
        },
        {
          "action": "Manage email updates from sponsored accounts",
          "note": "Sponsorships only."
        },
        {
          "action": "Attribute your sponsorships to another organization",
          "note": "Sponsorships only."
        },
        {
          "action": "List apps in GitHub Marketplace",
          "note": "Listing an app the organization publishes."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-member",
      "name": "Member",
      "kind": "organization",
      "scope": "The organization",
      "summary": "Standard access to organization features. Repository access comes from the base permission, teams and direct grants.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 2,
      "plane": "data",
      "why": "Tier 2 because it includes Repository creation: Write (repository).",
      "decidingPermissions": [
        "repository_creation:write"
      ],
      "permissions": [
        {
          "permissionId": "repository_creation:write",
          "source": "documented",
          "via": [
            "Create repositories"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Hide comments on writable commits, pull requests, and issues"
          ],
          "partial": {
            "tier": 3,
            "why": "Moderation on repositories they can already write to."
          }
        },
        {
          "permissionId": "members:read",
          "source": "documented",
          "via": [
            "See all organization members and teams"
          ]
        },
        {
          "permissionId": "members:write",
          "source": "inferred",
          "via": [
            "Create teams"
          ],
          "partial": {
            "tier": 3,
            "why": "Creates a team. Giving it repository access needs a repository admin."
          }
        }
      ],
      "uncovered": [
        {
          "action": "@mention any visible team",
          "note": "Notifications only."
        },
        {
          "action": "Can be made a team maintainer",
          "note": "Eligibility, not a grant. See the Team maintainer role."
        }
      ],
      "contextDependent": true,
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-moderator",
      "name": "Moderator",
      "kind": "organization",
      "scope": "The organization's public spaces",
      "summary": "Moderates discussions and community content.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 2,
      "plane": "data",
      "why": "Tier 2 because it includes Repository creation: Write (repository).",
      "decidingPermissions": [
        "repository_creation:write"
      ],
      "permissions": [
        {
          "permissionId": "repository_creation:write",
          "source": "documented",
          "via": [
            "Create repositories"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Hide comments on writable commits, pull requests, and issues",
            "Hide comments on all commits, pull requests, and issues"
          ],
          "partial": {
            "tier": 3,
            "why": "Moderation on repositories they can already write to."
          }
        },
        {
          "permissionId": "members:read",
          "source": "documented",
          "via": [
            "See all organization members and teams"
          ]
        },
        {
          "permissionId": "members:write",
          "source": "inferred",
          "via": [
            "Create teams"
          ],
          "partial": {
            "tier": 3,
            "why": "Creates a team. Giving it repository access needs a repository admin."
          }
        },
        {
          "permissionId": "organization_administration:write",
          "source": "inferred",
          "via": [
            "Limit interactions for certain users in public repositories"
          ],
          "partial": {
            "tier": 3,
            "why": "Moderation setting."
          }
        },
        {
          "permissionId": "organization_user_blocking:write",
          "source": "documented",
          "via": [
            "Block and unblock non-member contributors"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "@mention any visible team",
          "note": "Notifications only."
        },
        {
          "action": "Can be made a team maintainer",
          "note": "Eligibility, not a grant. See the Team maintainer role."
        }
      ],
      "contextDependent": true,
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-billing-manager",
      "name": "Billing manager",
      "kind": "organization",
      "scope": "Organization billing",
      "summary": "Views and manages billing settings.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 3,
      "plane": "data",
      "why": "None of its abilities map to a permission on the reference, so it gets the lowest tier.",
      "decidingPermissions": [],
      "permissions": [],
      "uncovered": [
        {
          "action": "View and edit billing information",
          "note": "Billing only. No permission on the reference covers organization billing."
        },
        {
          "action": "Sponsor accounts and manage the organization's sponsorships",
          "note": "Sponsorships and payments only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud"
        ],
        "notes": {
          "enterprise-cloud": "only in organizations not owned by an enterprise account"
        },
        "source": "https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/adding-a-billing-manager-to-your-organization"
      }
    },
    {
      "id": "org-security-manager",
      "name": "Security manager",
      "kind": "organization",
      "scope": "The organization and every repository in it",
      "summary": "Manages security policies, alerts and configurations across the organization.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 1,
      "plane": "management",
      "why": "Tier 1 because it includes Secret scanning alerts: Read (repository), Administration: Write (organization) (in part).",
      "decidingPermissions": [
        "secret_scanning_alerts:read",
        "organization_administration:write"
      ],
      "permissions": [
        {
          "permissionId": "organization_administration:write",
          "source": "inferred",
          "via": [
            "Manage security and analysis settings"
          ],
          "partial": {
            "tier": 1,
            "why": "Security configurations for every repository. Can switch secret scanning, push protection and code scanning off org-wide."
          }
        },
        {
          "permissionId": "secret_scanning_alerts:read",
          "source": "documented",
          "via": [
            "Security managers can view and manage security alerts in every repository in the organization."
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "inferred",
          "via": [
            "Manage Dependabot security updates"
          ],
          "partial": {
            "tier": 2,
            "why": "Can turn automated security fixes off."
          }
        },
        {
          "permissionId": "organization_code_scanning_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review and manage code scanning dismissal requests"
          ]
        },
        {
          "permissionId": "organization_dependabot_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review Dependabot alert dismissal requests",
            "Bypass Dependabot alert dismissal requests"
          ]
        },
        {
          "permissionId": "organization_secret_scanning_bypass_requests:write",
          "source": "documented",
          "via": [
            "Review and manage secret scanning bypass requests"
          ]
        },
        {
          "permissionId": "repository_creation:write",
          "source": "documented",
          "via": [
            "Create repositories"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "documented",
          "via": [
            "Security managers can view and manage security alerts in every repository in the organization."
          ]
        },
        {
          "permissionId": "secret_scanning_dismissal_requests:write",
          "source": "documented",
          "via": [
            "Review and manage secret scanning dismissal requests"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "Security managers can view and manage security alerts in every repository in the organization."
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Security managers can view and manage security alerts in every repository in the organization."
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull (read) all repositories in the organization"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Hide comments on writable commits, pull requests, and issues",
            "Hide comments on all commits, pull requests, and issues"
          ],
          "partial": {
            "tier": 3,
            "why": "Moderation on repositories they can already write to."
          }
        },
        {
          "permissionId": "members:read",
          "source": "documented",
          "via": [
            "See all organization members and teams"
          ]
        },
        {
          "permissionId": "members:write",
          "source": "inferred",
          "via": [
            "Create teams"
          ],
          "partial": {
            "tier": 3,
            "why": "Creates a team. Giving it repository access needs a repository admin."
          }
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View security overview for the organization"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "View security overview for the organization",
            "Receive Dependabot alerts about insecure dependencies for all of an organization's repositories"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "@mention any visible team",
          "note": "Notifications only."
        },
        {
          "action": "Can be made a team maintainer",
          "note": "Eligibility, not a grant. See the Team maintainer role."
        },
        {
          "action": "Sponsor accounts and manage the organization's sponsorships",
          "note": "Sponsorships and payments only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-app-manager",
      "name": "App manager",
      "kind": "organization",
      "scope": "GitHub Apps owned by the organization",
      "summary": "Creates, edits and deletes GitHub App registrations owned by the organization.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 1,
      "plane": "management",
      "why": "Managing an App registration is not a permission on the reference. It decides what an organization-owned App asks for and where its webhooks go, which reaches every repository that App is installed on.",
      "decidingPermissions": [],
      "permissions": [
        {
          "permissionId": "repository_creation:write",
          "source": "documented",
          "via": [
            "Create repositories"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Hide comments on writable commits, pull requests, and issues"
          ],
          "partial": {
            "tier": 3,
            "why": "Moderation on repositories they can already write to."
          }
        },
        {
          "permissionId": "members:read",
          "source": "documented",
          "via": [
            "See all organization members and teams"
          ]
        },
        {
          "permissionId": "members:write",
          "source": "inferred",
          "via": [
            "Create teams"
          ],
          "partial": {
            "tier": 3,
            "why": "Creates a team. Giving it repository access needs a repository admin."
          }
        }
      ],
      "uncovered": [
        {
          "action": "@mention any visible team",
          "note": "Notifications only."
        },
        {
          "action": "Can be made a team maintainer",
          "note": "Eligibility, not a grant. See the Team maintainer role."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-cicd-admin",
      "name": "CI/CD admin",
      "kind": "organization",
      "scope": "The organization's Actions setup",
      "summary": "Manages Actions policies, runners, runner groups, hosted compute networks, secrets, variables and usage metrics.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 1,
      "plane": "management",
      "why": "Tier 1 because it includes Network configurations: Write (organization), Secrets: Write (organization), Self-hosted runners: Write (organization) and 1 more.",
      "decidingPermissions": [
        "organization_network_configurations:write",
        "organization_secrets:write",
        "organization_self_hosted_runners:write",
        "organization_administration:write"
      ],
      "permissions": [
        {
          "permissionId": "organization_administration:write",
          "source": "inferred",
          "via": [
            "Actions policies are part of organization Administration."
          ],
          "partial": {
            "tier": 1,
            "why": "Only the Actions policy part of organization Administration: which actions may run and what workflow tokens get."
          }
        },
        {
          "permissionId": "organization_network_configurations:write",
          "source": "documented",
          "via": [
            "Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics."
          ]
        },
        {
          "permissionId": "organization_secrets:write",
          "source": "documented",
          "via": [
            "Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics."
          ]
        },
        {
          "permissionId": "organization_self_hosted_runners:write",
          "source": "documented",
          "via": [
            "Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics."
          ]
        },
        {
          "permissionId": "organization_actions_variables:write",
          "source": "documented",
          "via": [
            "Grants admin access to manage Actions policies, runners, runner groups, hosted compute network configurations, secrets, variables, and usage metrics."
          ]
        }
      ],
      "uncovered": [],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-all-repo-read",
      "name": "All-repository read",
      "kind": "organization",
      "scope": "Every repository in the organization",
      "summary": "Read on every repository.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 3,
      "plane": "data",
      "why": "Tier 3 because nothing it includes goes beyond Tier 3.",
      "decidingPermissions": [
        "actions:read",
        "administration:read",
        "contents:read",
        "packages:read",
        "security_events:read",
        "codespaces:write",
        "discussions:write",
        "issues:write",
        "pull_requests:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for public repositories"
          ],
          "partial": {
            "tier": 3,
            "why": "A codespace with the person's own access and no repository secrets."
          }
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Create new discussions and comment on existing discussions"
          ],
          "partial": {
            "tier": 3,
            "why": "Posting, not moderating."
          }
        },
        {
          "permissionId": "issues:write",
          "source": "inferred",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves"
          ],
          "partial": {
            "tier": 3,
            "why": "Opening and commenting on issues, not editing anyone else's."
          }
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "inferred",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests"
          ],
          "partial": {
            "tier": 3,
            "why": "Proposes changes; nothing lands without someone with write access."
          }
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-all-repo-triage",
      "name": "All-repository triage",
      "kind": "organization",
      "scope": "Every repository in the organization",
      "summary": "Triage on every repository.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 2,
      "plane": "data",
      "why": "Tier 2 because it includes Discussions: Write (repository), Issues: Write (repository), Pull requests: Write (repository).",
      "decidingPermissions": [
        "discussions:write",
        "issues:write",
        "pull_requests:write"
      ],
      "permissions": [
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Move a discussion to a different category",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Apply milestones",
            "Mark duplicate issues and pull requests"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Request pull request reviews"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for public repositories"
          ],
          "partial": {
            "tier": 3,
            "why": "A codespace with the person's own access and no repository secrets."
          }
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-all-repo-write",
      "name": "All-repository write",
      "kind": "organization",
      "scope": "Every repository in the organization",
      "summary": "Write on every repository.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 1,
      "plane": "data",
      "why": "Tier 1 because it includes Actions: Write (repository), Packages: Write (repository), Secrets: Write (repository) and 1 more.",
      "decidingPermissions": [
        "actions:write",
        "packages:write",
        "secrets:write",
        "workflows:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages"
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-all-repo-maintain",
      "name": "All-repository maintain",
      "kind": "organization",
      "scope": "Every repository in the organization",
      "summary": "Maintain on every repository.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 1,
      "plane": "management",
      "why": "Tier 1 because it includes Actions: Write (repository), Administration: Write (repository), Packages: Write (repository) and 2 more.",
      "decidingPermissions": [
        "actions:write",
        "administration:write",
        "packages:write",
        "secrets:write",
        "workflows:write"
      ],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "documented",
          "via": [
            "Edit a repository's description",
            "Manage topics",
            "Enable wikis and restrict wiki editors",
            "Configure pull request merges",
            "Create and edit repository social cards",
            "Limit interactions in a repository",
            "Enable GitHub Discussions in a repository"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages"
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Push to protected branches",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues"
          ]
        },
        {
          "permissionId": "pages:write",
          "source": "documented",
          "via": [
            "Configure a publishing source for GitHub Pages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        },
        {
          "action": "View content exclusion settings for GitHub Copilot",
          "note": "Viewing a setting."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "org-all-repo-admin",
      "name": "All-repository admin",
      "kind": "organization",
      "scope": "Every repository in the organization",
      "summary": "Admin on every repository.",
      "docsUrl": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles",
      "tier": 0,
      "plane": "control",
      "why": "Admin on every repository at once: it can make every repository public, read and replace every repository secret, remove every branch protection and add collaborators anywhere. Each permission is Tier 1 on one repository; across the whole organization it is organization scale.",
      "decidingPermissions": [],
      "permissions": [
        {
          "permissionId": "actions:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "administration:write",
          "source": "documented",
          "via": [
            "Manage individual, team, and outside collaborator access to the repository",
            "Edit a repository's description",
            "Manage topics",
            "Enable wikis and restrict wiki editors",
            "Configure pull request merges",
            "Manage branch protection rules and repository rulesets",
            "Merge pull requests on protected branches, even if there are no approving reviews",
            "Create and edit repository social cards",
            "Limit interactions in a repository",
            "Add a repository to a team",
            "Manage outside collaborator access to a repository",
            "Change a repository's visibility",
            "Make a repository a template",
            "Change a repository's settings",
            "Manage team and collaborator access to the repository",
            "Edit the repository's default branch",
            "Rename the repository's default branch",
            "Manage webhooks and deploy keys",
            "Manage the forking policy for a repository",
            "Transfer repositories into the organization",
            "Delete or transfer repositories out of the organization",
            "Archive repositories",
            "Display a sponsor button",
            "Create autolink references to external resources, like Jira or Zendesk",
            "Enable GitHub Discussions in a repository",
            "Manage access to GitHub Advanced Security features",
            "Enable the dependency graph for a private repository"
          ]
        },
        {
          "permissionId": "packages:write",
          "source": "documented",
          "via": [
            "Publish packages",
            "Delete and restore packages"
          ]
        },
        {
          "permissionId": "repository_custom_properties:write",
          "source": "documented",
          "via": [
            "Edit the custom property values for the repository"
          ]
        },
        {
          "permissionId": "repository_hooks:write",
          "source": "documented",
          "via": [
            "Manage webhooks and deploy keys"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:read",
          "source": "documented",
          "via": [
            "Unlike writers and maintainers, admins see every secret scanning alert in the repository, including the leaked values."
          ]
        },
        {
          "permissionId": "secrets:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions secrets on GitHub.com",
            "Create, update, and delete GitHub Actions secrets using the REST API"
          ]
        },
        {
          "permissionId": "workflows:write",
          "source": "inferred",
          "via": [
            "Create, edit, run, re-run, and cancel GitHub Actions workflows"
          ]
        },
        {
          "permissionId": "actions_variables:write",
          "source": "documented",
          "via": [
            "Create, update, and delete GitHub Actions variables on GitHub.com",
            "Create, update, and delete GitHub Actions variables using the REST API"
          ]
        },
        {
          "permissionId": "checks:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "codespaces:write",
          "source": "inferred",
          "via": [
            "Create codespaces for private repositories",
            "Create codespaces for private repositories with Codespaces secrets access",
            "Create codespaces for public repositories"
          ]
        },
        {
          "permissionId": "contents:write",
          "source": "documented",
          "via": [
            "Apply suggested changes to pull requests",
            "Merge a pull request",
            "Push to (write) the person or team's assigned repositories",
            "Create and edit releases",
            "Push to protected branches",
            "Define code owners for a repository",
            "Rename a branch other than the repository's default branch"
          ]
        },
        {
          "permissionId": "discussions:write",
          "source": "inferred",
          "via": [
            "Hide anyone's comments on discussions",
            "Create and edit categories for GitHub Discussions",
            "Move a discussion to a different category",
            "Transfer a discussion to a new repository",
            "Manage pinned discussions",
            "Lock and unlock discussions",
            "Individually convert issues to discussions",
            "Create new discussions and comment on existing discussions",
            "Delete a discussion"
          ]
        },
        {
          "permissionId": "issues:write",
          "source": "documented",
          "via": [
            "Open issues",
            "Close issues they opened themselves",
            "Reopen issues they closed themselves",
            "Apply/dismiss labels",
            "Create, edit, delete labels",
            "Close, reopen, and assign all issues and pull requests",
            "Create, edit, delete milestones",
            "Apply milestones",
            "Mark duplicate issues and pull requests",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Lock conversations",
            "Transfer issues",
            "Delete an issue"
          ]
        },
        {
          "permissionId": "pages:write",
          "source": "documented",
          "via": [
            "Configure a publishing source for GitHub Pages"
          ]
        },
        {
          "permissionId": "pull_requests:write",
          "source": "documented",
          "via": [
            "Send pull requests from forks of the team's assigned repositories",
            "Submit reviews on pull requests",
            "Approve or request changes to a pull request with required reviews",
            "Apply/dismiss labels",
            "Close, reopen, and assign all issues and pull requests",
            "Enable and disable auto-merge on a pull request",
            "Request pull request reviews",
            "Edit and delete anyone's comments on commits, pull requests, and issues",
            "Hide anyone's comments on issues, pull requests, and commits",
            "Mark a draft pull request as ready for review",
            "Convert a pull request to a draft"
          ]
        },
        {
          "permissionId": "repository_advisories:write",
          "source": "documented",
          "via": [
            "Create security advisories"
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "inferred",
          "via": [
            "View and dismiss secret scanning alerts in a repository"
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "List, dismiss, and delete code scanning alerts"
          ]
        },
        {
          "permissionId": "statuses:write",
          "source": "documented",
          "via": [
            "Create status checks"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "Dismiss Dependabot alerts"
          ]
        },
        {
          "permissionId": "actions:read",
          "source": "documented",
          "via": [
            "View GitHub Actions workflow runs"
          ]
        },
        {
          "permissionId": "administration:read",
          "source": "documented",
          "via": [
            "View rulesets for a repository"
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "Pull from the person or team's assigned repositories",
            "Fork the person or team's assigned repositories",
            "View published releases",
            "View draft releases"
          ]
        },
        {
          "permissionId": "packages:read",
          "source": "documented",
          "via": [
            "View and install packages"
          ]
        },
        {
          "permissionId": "security_events:read",
          "source": "documented",
          "via": [
            "View code scanning alerts on pull requests"
          ]
        },
        {
          "permissionId": "vulnerability_alerts:read",
          "source": "documented",
          "via": [
            "Receive Dependabot alerts for insecure dependencies in a repository"
          ]
        }
      ],
      "uncovered": [
        {
          "action": "Edit and delete their own comments",
          "note": "Only the person's own comments."
        },
        {
          "action": "Have an issue assigned to them",
          "note": "Being assigned grants nothing."
        },
        {
          "action": "Edit wikis in public repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Edit wikis in private repositories",
          "note": "Wikis have no API permission. Wiki edits do not change code or settings."
        },
        {
          "action": "Report abusive or spammy content",
          "note": "Moderation report only."
        },
        {
          "action": "Act as a designated code owner for a repository",
          "note": "A code owner's approval can satisfy a review rule. It is a special grant made in the CODEOWNERS file, not a permission."
        },
        {
          "action": "View content exclusion settings for GitHub Copilot",
          "note": "Viewing a setting."
        }
      ],
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-predefined-organization-roles"
      }
    },
    {
      "id": "team-maintainer",
      "name": "Team maintainer",
      "kind": "team",
      "scope": "One team and the repositories it has",
      "summary": "Manages a team's members and settings.",
      "docsUrl": "https://docs.github.com/en/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member",
      "tier": 1,
      "plane": "control",
      "why": "Tier 1 because it includes Members: Write (organization) (in part).",
      "decidingPermissions": [
        "members:write"
      ],
      "permissions": [
        {
          "permissionId": "members:write",
          "source": "documented",
          "via": [
            "Team maintainers can add and remove team members and change the team's settings."
          ],
          "partial": {
            "tier": 1,
            "why": "Only for their own team, but anyone they add gets every repository role the team holds. On a team with Admin on production repositories, that is a path to those repositories."
          }
        }
      ],
      "uncovered": [],
      "contextDependent": true,
      "availability": {
        "on": [
          "free",
          "team",
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/organizations/organizing-members-into-teams/assigning-the-team-maintainer-role-to-a-team-member"
      }
    },
    {
      "id": "enterprise-owner",
      "name": "Enterprise owner",
      "kind": "enterprise",
      "scope": "Every organization in the enterprise",
      "summary": "Manages all enterprise settings, members and policies.",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 0,
      "plane": "control",
      "why": "Tier 0 because it includes Custom enterprise roles: Write (enterprise), Enterprise SCIM: Write (enterprise), Enterprise teams: Write (enterprise).",
      "decidingPermissions": [
        "enterprise_custom_enterprise_roles:write",
        "enterprise_scim:write",
        "enterprise_teams:write"
      ],
      "permissions": [
        {
          "permissionId": "enterprise_custom_enterprise_roles:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_scim:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_teams:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_credentials:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_custom_properties:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_organization_installations:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        },
        {
          "permissionId": "enterprise_billing:write",
          "source": "documented",
          "via": [
            "Enterprise owners have complete control over the enterprise and can take every action, including managing administrators, members, settings, policy and billing."
          ]
        }
      ],
      "uncovered": [],
      "availability": {
        "on": [
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "enterprise-billing-manager",
      "name": "Enterprise billing manager",
      "kind": "enterprise",
      "scope": "Enterprise billing",
      "summary": "Views and manages licenses and usage-based billing.",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 2,
      "plane": "data",
      "why": "Tier 2 because it includes Enterprise billing: Write (enterprise), Enterprise Licensing: Write (enterprise).",
      "decidingPermissions": [
        "enterprise_billing:write",
        "enterprise_licensing:write"
      ],
      "permissions": [
        {
          "permissionId": "enterprise_billing:write",
          "source": "documented",
          "via": [
            "Billing managers only have access to your enterprise's billing settings."
          ]
        },
        {
          "permissionId": "enterprise_licensing:write",
          "source": "documented",
          "via": [
            "Billing managers only have access to your enterprise's billing settings."
          ]
        }
      ],
      "uncovered": [],
      "availability": {
        "on": [
          "enterprise-cloud",
          "emu"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "enterprise-app-manager",
      "name": "Enterprise App manager",
      "kind": "enterprise",
      "scope": "GitHub Apps owned by the enterprise",
      "summary": "Views, creates, edits and deletes enterprise-owned App registrations. Cannot install or uninstall Apps.",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 1,
      "plane": "management",
      "why": "Managing an App registration is not a permission on the reference. It decides what an enterprise-owned App asks for and where its webhooks go, which reaches every organization the App is installed in.",
      "decidingPermissions": [],
      "permissions": [],
      "uncovered": [],
      "availability": {
        "on": [
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "enterprise-security-manager",
      "name": "Enterprise security manager",
      "kind": "enterprise",
      "scope": "Every organization in the enterprise",
      "summary": "Manages security configurations and alerts enterprise-wide (public preview).",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 1,
      "plane": "data",
      "why": "Tier 1 because it includes Secret scanning alerts: Read (repository).",
      "decidingPermissions": [
        "secret_scanning_alerts:read"
      ],
      "permissions": [
        {
          "permissionId": "secret_scanning_alerts:read",
          "source": "documented",
          "via": [
            "They have read access for code in all repositories and write access for all security alerts in the enterprise."
          ]
        },
        {
          "permissionId": "secret_scanning_alerts:write",
          "source": "documented",
          "via": [
            "They have read access for code in all repositories and write access for all security alerts in the enterprise."
          ]
        },
        {
          "permissionId": "security_events:write",
          "source": "documented",
          "via": [
            "They have read access for code in all repositories and write access for all security alerts in the enterprise."
          ]
        },
        {
          "permissionId": "vulnerability_alerts:write",
          "source": "documented",
          "via": [
            "They have read access for code in all repositories and write access for all security alerts in the enterprise."
          ]
        },
        {
          "permissionId": "contents:read",
          "source": "documented",
          "via": [
            "They have read access for code in all repositories and write access for all security alerts in the enterprise."
          ]
        }
      ],
      "uncovered": [],
      "availability": {
        "on": [
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "notes": {
          "enterprise-cloud": "public preview",
          "emu": "public preview",
          "ghes": "public preview"
        },
        "source": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "enterprise-user",
      "name": "Enterprise user",
      "kind": "enterprise",
      "scope": "The enterprise",
      "summary": "A member with no administrative access. Access comes from organization roles.",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 3,
      "plane": "data",
      "why": "None of its abilities map to a permission on the reference, so it gets the lowest tier.",
      "decidingPermissions": [],
      "permissions": [],
      "uncovered": [],
      "contextDependent": true,
      "availability": {
        "on": [
          "enterprise-cloud",
          "emu",
          "ghes"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "enterprise-guest-collaborator",
      "name": "Guest collaborator",
      "kind": "enterprise",
      "scope": "Only what they are added to",
      "summary": "A managed user with limited access by default (Enterprise Managed Users only).",
      "docsUrl": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles",
      "tier": 3,
      "plane": "data",
      "why": "None of its abilities map to a permission on the reference, so it gets the lowest tier.",
      "decidingPermissions": [],
      "permissions": [],
      "uncovered": [],
      "contextDependent": true,
      "availability": {
        "on": [
          "emu"
        ],
        "source": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-accounts-and-repositories/managing-roles-in-your-enterprise/abilities-of-roles"
      }
    },
    {
      "id": "ghes-site-admin",
      "name": "Site administrator (Enterprise Server)",
      "kind": "enterprise",
      "scope": "The whole Enterprise Server instance",
      "summary": "Administers the GitHub Enterprise Server instance: users, organizations and repositories across it, and can promote other users to site administrator. Classic tokens for this role can carry the site_admin scope, which only exists on Enterprise Server.",
      "docsUrl": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator",
      "tier": 0,
      "plane": "control",
      "why": "Above every organization and enterprise role on the instance, and able to make more site administrators. No permission on the reference describes it.",
      "decidingPermissions": [],
      "permissions": [],
      "uncovered": [],
      "availability": {
        "on": [
          "ghes"
        ],
        "source": "https://docs.github.com/en/enterprise-server@latest/admin/managing-accounts-and-repositories/managing-users-in-your-enterprise/promoting-or-demoting-a-site-administrator"
      }
    }
  ],
  "orgRoleApiNames": {
    "all_repo_read": "org-all-repo-read",
    "all_repo_triage": "org-all-repo-triage",
    "all_repo_write": "org-all-repo-write",
    "all_repo_maintain": "org-all-repo-maintain",
    "all_repo_admin": "org-all-repo-admin",
    "ci_cd_admin": "org-cicd-admin",
    "security_manager": "org-security-manager",
    "app_manager": "org-app-manager"
  },
  "customRoleSources": {
    "repository": "https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/about-custom-repository-roles",
    "organization": "https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/permissions-of-custom-organization-roles"
  },
  "customRolePermissions": [
    {
      "id": "r-create-a-discussion-category",
      "name": "Create a discussion category",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write"
        }
      ]
    },
    {
      "id": "r-edit-a-discussion-category",
      "name": "Edit a discussion category",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write"
        }
      ]
    },
    {
      "id": "r-delete-a-discussion-category",
      "name": "Delete a discussion category",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write"
        }
      ]
    },
    {
      "id": "r-mark-or-unmark-discussion-answers",
      "name": "Mark or unmark discussion answers",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write",
          "partial": {
            "tier": 3,
            "why": "Discussion moderation."
          }
        }
      ]
    },
    {
      "id": "r-hide-or-unhide-discussion-comments",
      "name": "Hide or unhide discussion comments",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write",
          "partial": {
            "tier": 3,
            "why": "Moderation only; content is hidden, not changed."
          }
        }
      ]
    },
    {
      "id": "r-convert-issues-to-discussions",
      "name": "Convert issues to discussions",
      "kind": "repository",
      "section": "Discussions",
      "permissions": [
        {
          "permissionId": "discussions:write"
        }
      ]
    },
    {
      "id": "r-assign-or-remove-a-user",
      "name": "Assign or remove a user",
      "kind": "repository",
      "section": "Issue and pull requests",
      "permissions": [
        {
          "permissionId": "issues:write"
        },
        {
          "permissionId": "pull_requests:write"
        }
      ]
    },
    {
      "id": "r-add-or-remove-a-label",
      "name": "Add or remove a label",
      "kind": "repository",
      "section": "Issue and pull requests",
      "permissions": [
        {
          "permissionId": "issues:write"
        },
        {
          "permissionId": "pull_requests:write"
        }
      ]
    },
    {
      "id": "r-close-an-issue",
      "name": "Close an issue",
      "kind": "repository",
      "section": "Issue",
      "permissions": [
        {
          "permissionId": "issues:write"
        }
      ]
    },
    {
      "id": "r-reopen-a-closed-issue",
      "name": "Reopen a closed issue",
      "kind": "repository",
      "section": "Issue",
      "permissions": [
        {
          "permissionId": "issues:write"
        }
      ]
    },
    {
      "id": "r-delete-an-issue",
      "name": "Delete an issue",
      "kind": "repository",
      "section": "Issue",
      "permissions": [
        {
          "permissionId": "issues:write"
        }
      ]
    },
    {
      "id": "r-mark-an-issue-as-a-duplicate",
      "name": "Mark an issue as a duplicate",
      "kind": "repository",
      "section": "Issue",
      "permissions": [
        {
          "permissionId": "issues:write"
        }
      ]
    },
    {
      "id": "r-request-a-solo-merge",
      "name": "Request a solo merge",
      "kind": "repository",
      "section": "Merge queue",
      "permissions": [],
      "none": "Changes how the merge queue groups the pull request; it still has to pass its checks."
    },
    {
      "id": "r-jump-to-the-front-of-the-queue",
      "name": "Jump to the front of the queue",
      "kind": "repository",
      "section": "Merge queue",
      "permissions": [],
      "none": "Changes the order of the merge queue; the pull request still has to pass its checks."
    },
    {
      "id": "r-close-a-pull-request",
      "name": "Close a pull request",
      "kind": "repository",
      "section": "Pull request",
      "permissions": [
        {
          "permissionId": "pull_requests:write"
        }
      ]
    },
    {
      "id": "r-reopen-a-closed-pull-request",
      "name": "Reopen a closed pull request",
      "kind": "repository",
      "section": "Pull request",
      "permissions": [
        {
          "permissionId": "pull_requests:write"
        }
      ]
    },
    {
      "id": "r-request-a-pull-request-review",
      "name": "Request a pull request review",
      "kind": "repository",
      "section": "Pull request",
      "permissions": [
        {
          "permissionId": "pull_requests:write"
        }
      ]
    },
    {
      "id": "r-set-milestones",
      "name": "Set milestones",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "issues:write"
        }
      ]
    },
    {
      "id": "r-manage-wiki-settings",
      "name": "Manage wiki settings",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 3,
            "why": "Wiki settings only."
          }
        }
      ]
    },
    {
      "id": "r-manage-project-settings",
      "name": "Manage project settings",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 3,
            "why": "Turns projects on or off for the repository."
          }
        }
      ]
    },
    {
      "id": "r-manage-pull-request-merging-settings",
      "name": "Manage pull request merging settings",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 2,
            "why": "Merge methods and auto-merge, not branch protection."
          }
        }
      ]
    },
    {
      "id": "r-manage-github-pages-settings",
      "name": "Manage GitHub Pages settings",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "pages:write"
        }
      ]
    },
    {
      "id": "r-manage-webhooks",
      "name": "Manage webhooks",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "repository_hooks:write"
        }
      ]
    },
    {
      "id": "r-manage-deploy-keys",
      "name": "Manage deploy keys",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write"
        }
      ]
    },
    {
      "id": "r-edit-repository-metadata",
      "name": "Edit repository metadata",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 3,
            "why": "Description, topics and website."
          }
        }
      ]
    },
    {
      "id": "r-set-interaction-limits",
      "name": "Set interaction limits",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 3,
            "why": "Moderation setting."
          }
        }
      ]
    },
    {
      "id": "r-set-the-social-preview",
      "name": "Set the social preview",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write",
          "partial": {
            "tier": 3,
            "why": "Cosmetic repository setting."
          }
        }
      ]
    },
    {
      "id": "r-push-commits-to-protected-branches",
      "name": "Push commits to protected branches",
      "kind": "repository",
      "section": "Repository",
      "notes": [
        "Base role must be write",
        "Branch protection rules will still apply"
      ],
      "needsWrite": true,
      "permissions": [
        {
          "permissionId": "contents:write"
        }
      ]
    },
    {
      "id": "r-create-protected-tags",
      "name": "Create protected tags",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "contents:write"
        }
      ]
    },
    {
      "id": "r-delete-protected-tags",
      "name": "Delete protected tags",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "contents:write"
        }
      ]
    },
    {
      "id": "r-bypass-branch-protections",
      "name": "Bypass branch protections",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "contents:write"
        }
      ]
    },
    {
      "id": "r-edit-repository-rules",
      "name": "Edit repository rules",
      "kind": "repository",
      "section": "Repository",
      "permissions": [
        {
          "permissionId": "administration:write"
        }
      ]
    },
    {
      "id": "r-view-code-scanning-alerts",
      "name": "View code scanning alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "security_events:read"
        }
      ]
    },
    {
      "id": "r-dismiss-or-reopen-code-scanning-alerts",
      "name": "Dismiss or reopen code scanning alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "security_events:write"
        }
      ]
    },
    {
      "id": "r-delete-code-scanning-alerts",
      "name": "Delete code scanning alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "security_events:write"
        }
      ]
    },
    {
      "id": "r-view-dependabot-alerts",
      "name": "View Dependabot alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "vulnerability_alerts:read"
        }
      ]
    },
    {
      "id": "r-dismiss-or-reopen-dependabot-alerts",
      "name": "Dismiss or reopen Dependabot alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "vulnerability_alerts:write"
        }
      ]
    },
    {
      "id": "r-view-secret-scanning-alerts",
      "name": "View secret scanning alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "secret_scanning_alerts:read"
        }
      ]
    },
    {
      "id": "r-dismiss-reopen-or-assign-secret-scanning-alerts",
      "name": "Dismiss, reopen, or assign secret scanning alerts",
      "kind": "repository",
      "section": "Security",
      "permissions": [
        {
          "permissionId": "secret_scanning_alerts:write"
        }
      ]
    },
    {
      "id": "r-manage-github-actions-general-settings",
      "name": "Manage GitHub Actions general settings",
      "kind": "repository",
      "section": "Actions",
      "permissions": [
        {
          "permissionId": "administration:write"
        }
      ]
    },
    {
      "id": "r-manage-runners",
      "name": "Manage runners",
      "kind": "repository",
      "section": "Actions",
      "permissions": [
        {
          "permissionId": "administration:write"
        }
      ]
    },
    {
      "id": "r-manage-secrets",
      "name": "Manage secrets",
      "kind": "repository",
      "section": "Actions",
      "permissions": [
        {
          "permissionId": "secrets:write"
        }
      ]
    },
    {
      "id": "r-manage-variables",
      "name": "Manage variables",
      "kind": "repository",
      "section": "Actions",
      "permissions": [
        {
          "permissionId": "actions_variables:write"
        }
      ]
    },
    {
      "id": "r-manage-environments-including-environment-secrets-and-variables",
      "name": "Manage environments (including environment secrets and variables)",
      "kind": "repository",
      "section": "Actions",
      "permissions": [
        {
          "permissionId": "environments:write"
        },
        {
          "permissionId": "secrets:write"
        },
        {
          "permissionId": "actions_variables:write"
        }
      ]
    },
    {
      "id": "o-manage-custom-organization-roles",
      "name": "Manage custom organization roles",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_org_roles:write"
        }
      ]
    },
    {
      "id": "o-view-organization-roles",
      "name": "View organization roles",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_org_roles:read"
        }
      ]
    },
    {
      "id": "o-manage-custom-repository-roles",
      "name": "Manage custom repository roles",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_roles:write"
        }
      ]
    },
    {
      "id": "o-view-custom-repository-roles",
      "name": "View custom repository roles",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_roles:read"
        }
      ]
    },
    {
      "id": "o-manage-organization-webhooks",
      "name": "Manage organization webhooks",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_hooks:write"
        }
      ]
    },
    {
      "id": "o-manage-organization-oauth-app-policies",
      "name": "Manage organization OAuth app policies",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_administration:write",
          "partial": {
            "tier": 2,
            "why": "Decides which OAuth apps may use members' access to the organization."
          }
        }
      ]
    },
    {
      "id": "o-edit-custom-properties-values-at-the-organization-level",
      "name": "Edit custom properties values at the organization level",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_properties:write"
        }
      ]
    },
    {
      "id": "o-manage-the-organization-s-custom-properties-definitions",
      "name": "Manage the organization's custom properties definitions",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_custom_properties:admin"
        }
      ]
    },
    {
      "id": "o-manage-organization-ref-update-rules-and-rulesets",
      "name": "Manage organization ref update rules and rulesets",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_administration:write",
          "partial": {
            "tier": 1,
            "why": "Organization rulesets: can loosen or remove the rules on every repository."
          }
        }
      ]
    },
    {
      "id": "o-view-organization-audit-log",
      "name": "View organization audit log",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_administration:read"
        }
      ]
    },
    {
      "id": "o-manage-organization-actions-policies",
      "name": "Manage organization Actions policies",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_administration:write",
          "partial": {
            "tier": 1,
            "why": "Only the Actions policy part of organization Administration: which actions may run and what workflow tokens get."
          }
        }
      ]
    },
    {
      "id": "o-manage-organization-actions-secrets",
      "name": "Manage organization Actions secrets",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_secrets:write"
        }
      ]
    },
    {
      "id": "o-manage-organization-actions-variables",
      "name": "Manage organization Actions variables",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_actions_variables:write"
        }
      ]
    },
    {
      "id": "o-manage-organization-hosted-runner-custom-images",
      "name": "Manage organization hosted runner custom images",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_runner_custom_images:write"
        }
      ]
    },
    {
      "id": "o-manage-organization-runners-and-runner-groups",
      "name": "Manage organization runners and runner groups",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_self_hosted_runners:write"
        }
      ]
    },
    {
      "id": "o-view-organization-actions-metrics",
      "name": "View organization Actions metrics",
      "kind": "organization",
      "section": "Organization",
      "permissions": [],
      "none": "Usage metrics only."
    },
    {
      "id": "o-view-organization-hosted-runner-custom-images",
      "name": "View organization hosted runner custom images",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_runner_custom_images:read"
        }
      ]
    },
    {
      "id": "o-review-and-manage-secret-scanning-bypass-requests",
      "name": "Review and manage secret scanning bypass requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_secret_scanning_bypass_requests:write"
        }
      ]
    },
    {
      "id": "o-review-and-manage-secret-scanning-alert-dismissal-requests",
      "name": "Review and manage secret scanning alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "secret_scanning_dismissal_requests:write"
        }
      ]
    },
    {
      "id": "o-bypass-code-scanning-alert-dismissal-requests",
      "name": "Bypass code scanning alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_code_scanning_dismissal_requests:write"
        }
      ]
    },
    {
      "id": "o-review-code-scanning-alert-dismissal-requests",
      "name": "Review code scanning alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_code_scanning_dismissal_requests:write"
        }
      ]
    },
    {
      "id": "o-view-code-scanning-alert-dismissal-requests",
      "name": "View code scanning alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_code_scanning_dismissal_requests:read"
        }
      ]
    },
    {
      "id": "o-bypass-dependabot-alert-dismissal-requests",
      "name": "Bypass Dependabot alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_dependabot_dismissal_requests:write"
        }
      ]
    },
    {
      "id": "o-review-dependabot-alert-dismissal-requests",
      "name": "Review Dependabot alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_dependabot_dismissal_requests:write"
        }
      ]
    },
    {
      "id": "o-view-dependabot-alert-dismissal-requests",
      "name": "View Dependabot alert dismissal requests",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_dependabot_dismissal_requests:read"
        }
      ]
    },
    {
      "id": "o-view-organization-copilot-metrics",
      "name": "View organization Copilot metrics",
      "kind": "organization",
      "section": "Organization",
      "permissions": [
        {
          "permissionId": "organization_copilot_metrics:read"
        }
      ]
    }
  ]
}