Question

An enterprise security team wants a group of engineers to be able to view and dismiss code scanning and Dependabot alerts across all repositories in an organization, and to configure security settings, but the team must NOT be granted the ability to push code or administer repository settings unrelated to security. Which approach best satisfies this least-privilege governance requirement?

Accepted Answer

Assign the team the organization-level 'security manager' role, which grants read access to all repositories plus the ability to manage security alerts and settings without broader admin rights.

Answer

Grant the team the 'admin' role on every repository so they can manage alerts and configuration.

Answer

Add the team as organization 'owners' so they can view and dismiss alerts everywhere.

Answer

Give each engineer 'write' access to all repositories, which includes alert dismissal permissions.