What's changed: New GH-500 Chapter 6 (large-scale rollout & defaults = enterprise→org→repo hierarchy and inheritance, GHEC vs GHES differences, enabling each feature, default security configurations [recommended/custom]; governance & automation = policy/ruleset enforcement, enforcement boundaries/bypass/exceptions [approval-gated + recorded], roles [admin/security manager/developer] and alert permissions, default/approved custom CodeQL workflows, APIs/automation to govern hundreds–thousands of repos)
6.2Governance, Access, CodeQL Workflows, and Automation
Understand defining enterprise/org security policies and rulesets, configuring enforcement boundaries/bypass permissions/exceptions, the admin/security-manager/developer roles, permissions to manage/dismiss alerts, enabling default/approved custom CodeQL workflows, and APIs/automation for large-scale security configuration and governance.
After enabling features, next is governance. Who can do what, how far to enforce, and where to allow exceptions—operate this at scale via policies and rulesets, roles and permissions, and APIs/automation.
6.2.1Policies, rulesets, and enforcement boundaries
Enterprises/orgs define security policies and rulesets and enforce required features, required checks, and remediation SLAs. Enforcement boundaries set "which scope (whole enterprise / specific orgs / specific repo sets) they apply to," and bypass permissions and exceptions control "who may waive, when, with approval." This balances uniform enforcement with on-the-ground flexibility. Exceptions are recorded and auditable—importantly.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.