Keys & Policies

The key, setting or grant.

key: a credential with no scopes. policy: a setting that decides what everything else may do. grant: access given outside roles, like a bypass list. agent: an AI agent acting in a repository.

Where it applies: one repository, an organization, the enterprise, a user or an App.

Keys take the tier of what they act as; policies the tier of what changing them allows.T0: Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.T1: Management/pipeline plane. Control over deployments, CI/CD, or secrets.T2: User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.T3: Low impact. Reading, or changes that touch no access, code, credentials or availability.* context-dependent: what it is attached to decides the real tier.

Control: identity and administration. Management: settings and pipelines. Data: code, runs and content.