“Highest wins” is only part of how GitHub organization repository access works. A repository-specific grant can override a lower organization base permission, but access from different avenues can also combine. To manage a project safely, identify where each permission comes from before changing a role.
How GitHub organization repository permissions work
A permission is an action a user is allowed to perform; a role bundles permissions. GitHub’s organization repository roles are Read, Triage, Write, Maintain, and Admin, ordered from least to most access. The roles are not simply interchangeable points on a scale: each is designed for different responsibilities.
As an Amazon Associate I earn from qualifying purchases.
| Role | Typical fit | Access in brief |
|---|---|---|
| Read | People who need to view a repository and participate in discussion | Viewing and discussion; no code-writing access. |
| Triage | Issue, discussion, and pull-request coordinators who do not need to write code | Manages issues, discussions, and pull requests without write access. |
| Write | Active code contributors | Allows code contribution. |
| Maintain | Project managers who need repository-management powers | Repository management while avoiding sensitive or destructive actions. |
| Admin | People responsible for full repository administration | Full access, including security management and repository deletion. |
These are organization repository roles; do not assume the same role ladder applies to repositories owned by a personal account or to organization and enterprise settings more broadly. See GitHub’s organization repository role descriptions and its explanation of access permissions on GitHub.
When “highest wins” applies—and when it does not
Repository-specific access can override a lower base permission
An organization owner can set a base permission that determines the default access organization members have across organization repositories. That default does not apply to outside collaborators. If a member receives a higher repository-specific permission than the organization base permission, GitHub says the higher repository permission overrides the lower base permission. This is the specific case captured by “highest wins.”
#1 Best Overall
Different access grants can be additive
Do not treat every combination as a contest in which one role replaces another. GitHub’s custom-role documentation says, “Roles and permissions are additive.” For example, if an organization’s base permission is Write and a custom repository role based on Read adds extra permissions, members retain Write access plus the custom role’s additional permissions. GitHub may flag conflicting access as Mixed roles; inspect the contributing grants rather than guessing which one controls the result. See GitHub’s custom repository role documentation.
Choose the least-privileged role that fits the work
Start with the actions a person actually needs, not their job title. GitHub describes Triage for managing issues, discussions, and pull requests without code-writing access; Write for active contributors; Maintain for repository management without sensitive or destructive powers; and Admin for full control. For a project manager coordinating work but not responsible for sensitive repository settings, Maintain may fit better than Admin. Grant Admin only when the person’s responsibilities require its broader powers.
- Needs to view work and participate in discussion: consider Read.
- Needs to coordinate issues, discussions, or pull requests but not write code: consider Triage.
- Needs to contribute code: consider Write.
- Needs to manage the repository while avoiding sensitive or destructive actions: consider Maintain.
- Needs full repository control, including sensitive or destructive actions: consider Admin.
Confirm the specific actions each role permits in GitHub’s role documentation, since a role’s name alone does not describe every permission.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Find the source of a user’s access
For a project-level access check, someone with repository admin access can review the repository’s collaborators and teams. The distinction between direct grants and inherited organization or team access is essential: changing a direct grant will not necessarily remove access coming through another path.
- Open the repository, select Settings, then under Access select Collaborators & teams.
- Review both Direct access and Organization access to see whether the person’s access is assigned directly or comes through the organization or a team.
- If the person has a Mixed roles warning, inspect the listed access sources and determine which grant supplies each permission.
- Change the relevant source: adjust the organization base permission, the repository’s direct access, team access, or a custom role as appropriate.
- If repository access is inherited through a team hierarchy, change it at the parent team. Changes to or removal of a parent team’s repository access propagate to child teams.
GitHub documents this workflow in its guide to viewing a person’s role in an organization repository.
Check the effects before changing organization base permission
A change to the organization base permission affects existing members as well as new members. It does not automatically update permissions for private forks, so those need separate attention. Internal repositories also have a minimum visibility of Read even when the organization’s base permission is None. These scope differences matter when a broad default change is intended to reduce access; review GitHub’s base-permission guidance before applying it.
Rank #4
Custom repository roles: availability and limits
Custom repository roles let an organization build on an inherited role and add permissions not already included in that role. GitHub documents this feature for organizations on GitHub Enterprise Cloud. Its current documentation says an organization can create up to 20 custom repository roles; GitHub Enterprise Server versions earlier than 3.19 support up to five. These edition- and version-specific limits can change, so check the live documentation for your deployment before planning a role scheme.
Free tools Windows power users keep installed
One-click scans. No signup required.
When configuring a custom role, choose an inherited role first, then select additional permissions. GitHub says an additional permission cannot be selected if the inherited role already includes it. See GitHub’s instructions for creating custom repository roles.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
