← All permissions
Organization permission·organization_agent_secrets:write
Agent secrets: Write
Tier 2 · Medium
Why Tier 2
Creates and overwrites secrets given to the Copilot agent's environment. The agent's changes still go through a pull request, so this does not reach production on its own.
- Target
- Organization
- Plane
- DataSecrets: Actions, environment, Dependabot, Codespaces and agent secrets, private registries and OIDC.
- Granted by
- Fine-grained PAT, GitHub App
- Available on
- Free, Team, Enterprise Cloud, EMU
What it unlocks
5 REST endpoints need this permission. A few of them:
- PUT /orgs/{org}/agents/secrets/{secret_name}
- DELETE /orgs/{org}/agents/secrets/{secret_name}
- PUT /orgs/{org}/agents/secrets/{secret_name}/repositories
Roles that include it
No built-in role includes it. Only tokens, Apps or custom roles can grant it.
Classic scopes that reach it
Attack paths
No attack technique, escalation or incident on ghtier goes through this yet.