Question

At GlobalPay, a compliance analyst needs read-only visibility into Dependabot and code scanning alerts across all repositories in the 'payments' organization so they can produce audit reports. The analyst must NOT be able to dismiss alerts, change repository code, or modify security configurations. As the organization owner, what is the most appropriate way to grant this access?

Accepted Answer

Grant the analyst the organization-level 'View' permission for security alerts by assigning a custom organization role scoped to read alert data

Answer

Assign the analyst to a team and grant that team the 'security manager' organization role

Answer

Add the analyst as an organization owner so they can access Security Overview

Answer

Grant the analyst Write access to each repository so alerts appear in their view