Private repository access governance

Use the smallest repository role that supports the approved purpose.

• Read for most adopters and evaluators
• Triage for issues and pull-request participation
• Write only for active implementation
• Maintain only for trusted maintainers

The OGO owner sends invitations, confirms acceptance, changes roles, and revokes access directly in GitHub. OGO Admin records those actions but stores no GitHub token.

Require two-factor authentication, protected branches, pull-request review, required checks, restricted releases, and regular collaborator review.

Confirm identity, organization, approved purpose, GitHub account, role, continuing need, security events, and recognition preference.

Do not automatically transfer approval when a person changes employer, team, contractor status, client, or purpose.

Remove GitHub access and private communications, record the action, and follow applicable source-return, deletion, confidentiality, and attribution requirements.

Removing repository access cannot remotely erase a local clone already created by an authorized recipient.