What's changed: New GH-500 Chapter 6 (large-scale rollout & defaults = enterprise→org→repo hierarchy and inheritance, GHEC vs GHES differences, enabling each feature, default security configurations [recommended/custom]; governance & automation = policy/ruleset enforcement, enforcement boundaries/bypass/exceptions [approval-gated + recorded], roles [admin/security manager/developer] and alert permissions, default/approved custom CodeQL workflows, APIs/automation to govern hundreds–thousands of repos)
6.2Governance, Access, CodeQL Workflows, and Automation
Understand defining enterprise/org security policies and rulesets, configuring enforcement boundaries/bypass permissions/exceptions, the admin/security-manager/developer roles, permissions to manage/dismiss alerts, enabling default/approved custom CodeQL workflows, and APIs/automation for large-scale security configuration and governance.
After enabling features, next is governance. Who can do what, how far to enforce, and where to allow exceptions—operate this at scale via policies and rulesets, roles and permissions, and APIs/automation.
6.2.1Policies, rulesets, and enforcement boundaries
Enterprises/orgs define security policies and rulesets and enforce required features, required checks, and remediation SLAs. Enforcement boundaries set "which scope (whole enterprise / specific orgs / specific repo sets) they apply to," and bypass permissions and exceptions control "who may waive, when, with approval." This balances uniform enforcement with on-the-ground flexibility. Exceptions are recorded and auditable—importantly.
6.2.2Roles and alert permissions
Clearly separate roles—admins govern feature enablement, policies, and org settings; security managers oversee security policy, alert supervision, and exception approval (granted security read/manage independently of code-write access); developers fix alerts in their own code. Permissions to view, act on, and dismiss alerts are assigned per role to prevent inappropriate dismissal. Apply least privilege—give only the needed scope to the right people.
6.2.3CodeQL workflows and APIs/automation
Admins enable default or approved custom CodeQL workflows to standardize org-permitted analysis settings (preventing unauthorized changes). Large-scale security configuration/governance can’t be manual, so use APIs and automation—scripting bulk enablement, policy application, alert retrieval/aggregation, and reporting to consistently govern hundreds to thousands of repos. This raises coverage, compliance, and operational efficiency together.
Common: (1) Enterprises/orgs enforce required features/checks/SLAs via policies/rulesets; enforcement boundaries set scope; bypass permissions/exceptions are approval-gated and recorded. (2) Roles = admin (enablement/policy) / security manager (policy, oversight, exception approval—security management granted independently of code-write) / developer (fix); dismiss permission per role. (3) Default/approved custom CodeQL workflows standardize. (4) APIs/automation configure and govern hundreds–thousands of repos at scale.
Watch out: (1) The security-manager role is separate from code-write—grant security management at least privilege to the right people. (2) Bypass/exceptions are approval-gated and recorded (permanent waivers or no records are risky). (3) Permit only approved custom CodeQL workflows to prevent unauthorized changes. (4) At scale, don’t rely on manual work—use APIs/automation to avoid coverage gaps and inconsistency.
6.2.4Section summary
- Enforce required features/checks/SLAs via policies/rulesets; enforcement boundaries for scope; bypass/exceptions approval-gated and recorded
- Roles: admin / security manager (security mgmt independent of code-write) / developer; dismiss permission per role
- Standardize via default/approved custom CodeQL workflows (prevent unauthorized changes)
- Use APIs/automation to configure/govern hundreds–thousands of repos (not manual)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. For hundreds–thousands of repos, you want consistent bulk enablement, policy application, and alert aggregation. Best means?
Q2. Which role oversees security policy and manages alerts/exception approvals without code-write access?
Q3. You want to standardize org-permitted analysis settings and prevent unauthorized changes. Appropriate CodeQL workflow management?
Q4. Which is correct governance for policy bypass and exceptions?
Q5. To not just define but ensure compliance with required features and remediation SLAs in enterprise/org security policy, what is needed?
Q6. What is the most appropriate policy for assigning alert-dismiss permissions?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.