Role Reference
Roles for people and teams, from enterprise owner down to repository read, tiered by what they include.
26 roles
Setup
Kind
Plane
The role as GitHub names it. Custom roles build on these. | enterprise, organization, team or repository: where the role is assigned. | The highest tier among the permissions the role includes.T0: Control-plane equivalent. Full compromise of an org, enterprise, or app identity, or of every repository in it.T1: Management/pipeline plane. Control over deployments, CI/CD, or secrets.T2: User/workload plane. Real but bounded risk: standard collaboration, or stopping work by cutting spend or licenses.T3: Low impact. Reading, or changes that touch no access, code, credentials or availability.* context-dependent: what the role is attached to decides the real tier. | Where the role can change something, taken from the permissions that set its tier. | How many permissions the role includes. Expand a row to see each one with its own tier. | |
|---|---|---|---|---|---|
| Enterprise owner | enterprise | T0 | control | 7 | ↗▼ |
| Site administrator (Enterprise Server) | enterprise | T0 | control | – | ↗▼ |
| Owner | organization | T0 | control | 45 | ↗▼ |
| All-repository admin | organization | T0 | control | 27 | ↗▼ |
| Enterprise App manager | enterprise | T1 | management | – | ↗▼ |
| Enterprise security manager | enterprise | T1 | data | 5 | ↗▼ |
| Security manager | organization | T1 | management | 17 | ↗▼ |
| App manager | organization | T1 | management | 4 | ↗▼ |
| CI/CD admin | organization | T1 | management | 5 | ↗▼ |
| All-repository write | organization | T1 | data | 21 | ↗▼ |
| All-repository maintain | organization | T1 | management | 23 | ↗▼ |
| Team maintainer | team | T1* | control | 1 | ↗▼ |
| Write | repository | T1 | data | 21 | ↗▼ |
| Maintain | repository | T1 | management | 23 | ↗▼ |
| Admin | repository | T1* | management | 27 | ↗▼ |
| Collaborator on a personal repository | repository | T1 | data | 5 | ↗▼ |
| Enterprise billing manager | enterprise | T2 | data | 2 | ↗▼ |
| Member | organization | T2* | data | 4 | ↗▼ |
| Moderator | organization | T2* | data | 6 | ↗▼ |
| All-repository triage | organization | T2 | data | 9 | ↗▼ |
| Triage | repository | T2 | data | 9 | ↗▼ |
| Enterprise user | enterprise | T3* | data | – | ↗▼ |
| Guest collaborator | enterprise | T3* | data | – | ↗▼ |
| Billing manager | organization | T3 | data | – | ↗▼ |
| All-repository read | organization | T3 | data | 9 | ↗▼ |
| Read | repository | T3 | data | 9 | ↗▼ |
Role abilities from GitHub's repository and organization role tables, fetched 2026-10-11. Enterprise, team and some predefined roles are described in prose by GitHub; each role page links its source.