What's changed: Rewritten with structured blocks (diagrams, callouts, key points, quizzes)
4.1Permissions and Account Security
Learn the foundations of safe operation: the right permissions and strong authentication—repository roles and least privilege, granting via Teams, visibility (Public/Private/Internal), and account security with 2FA, PATs, and SSH.
Safe operation starts with the right permissions and strong authentication: who may do what and how far, and how you protect your own account. Getting these two right is the first step to protecting your team and yourself.
4.1.1Roles and least privilege
Repository roles increase in order: Read < Triage < Write < Maintain < Admin. Follow the principle of least privilege—grant each person only what their work requires, avoiding excess.
In an organization, grant permissions via Teams rather than to individuals. Teams can be nested, and a child team inherits the parent permissions. Base permissions set the default access for all org members, while non-members are invited per repository as outside collaborators.
4.1.2Visibility
- Public: viewable by anyone on the internet.
- Private: only permitted users.
- Internal: visible to members of the same Enterprise (good for InnerSource).
Before making a repository Public, always check for secrets or personal data. Once public, content may have been seen or copied.
4.1.3Account security
- Enable two-factor authentication (2FA); phishing-resistant passkeys/security keys are especially recommended. An org can require 2FA for all members.
- For Git auth, use a permission-scoped fine-grained Personal Access Token (PAT) or SSH keys, and avoid using or sharing your password.
- Keep secrets out of code; if leaked, rotate them promptly (revoke and reissue).
Common points: the role order Read < Triage < Write < Maintain < Admin, the principle of least privilege, Public/Private/Internal visibility, and 2FA/PAT/SSH. Also: grant permissions via Teams in an organization.
4.1.4Section summary
- Roles: Read < Triage < Write < Maintain < Admin; apply least privilege and grant via Teams in an org
- Visibility: Public / Private / Internal; check for secrets/PII before going public
- Account security: 2FA (prefer passkeys) / fine-grained PAT & SSH / rotate secrets
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which lists repository roles from least to most privileged?
Q2. Which visibility is viewable by anyone?
Q3. Which is NOT a recommended way to authenticate Git operations?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.