> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Repository Access Control

> Manage who can access specific repositories

Control which team members can access specific repositories for fine-grained security.

## Why Repository-Level Access?

<CardGroup cols={2}>
  <Card title="Confidentiality" icon="lock">
    Restrict access to sensitive projects
  </Card>

  <Card title="Compliance" icon="scale-balanced">
    Meet regulatory requirements
  </Card>

  <Card title="Organization" icon="diagram-project">
    Align access with team structure
  </Card>

  <Card title="Security" icon="shield">
    Limit exposure of security findings
  </Card>
</CardGroup>

***

## Default Access

By default, all organization members have access to all repositories.

Enable **Repository Access Control** to restrict access:

**Organization Settings** → **Security** → **Enable Repository Access Control**

<Warning>
  Enabling repository access control restricts access. Team members will only see repositories explicitly granted to them or their teams.
</Warning>

***

## Grant Repository Access

<Steps>
  <Step title="Navigate to Repository Settings">
    Repository → **Settings** → **Access**
  </Step>

  <Step title="Add Collaborator">
    Click **Add Collaborator**
  </Step>

  <Step title="Select User or Team">
    Choose individual users or teams
  </Step>

  <Step title="Set Permission Level">
    Choose permission:

    * **Admin**: Full repository control
    * **Write**: Manage findings, run scans
    * **Read**: View-only access
  </Step>

  <Step title="Save">
    Click **Grant Access**
  </Step>
</Steps>

***

## Permission Levels

### Admin (Repository)

**Can**:

* Configure repository settings
* Manage access control
* Run and configure scans
* Manage all violations
* Delete repository

**Use for**: Repository owners, security leads

### Write

**Can**:

* Run scans
* Assign violations
* Suppress violations
* Comment on violations
* Generate reports

**Cannot**:

* Change repository settings
* Manage access control
* Delete repository

**Use for**: Developers, security engineers

### Read

**Can**:

* View violations
* View scan results
* View reports
* Comment on violations

**Cannot**:

* Run scans
* Assign/suppress violations
* Modify anything

**Use for**: Stakeholders, managers, auditors

***

## Team-Based Access

Grant access to entire teams instead of individual users:

* Easier to manage at scale
* Access follows team membership
* Clear ownership structure
* Simplified onboarding/offboarding

***

## Access Inheritance

Final access is the combination of organization role and repository permission:

| Org Role | Repo Permission | Effective Access                                 |
| -------- | --------------- | ------------------------------------------------ |
| ADMIN    | Any             | Admin (org-level ADMINs always have full access) |
| USER     | Admin           | Admin                                            |
| USER     | Write           | Write                                            |
| USER     | Read            | Read                                             |
| USER     | None            | No access                                        |

<Note>
  Organization-level ADMIN role members bypass repository-level restrictions and always have admin access to all repositories.
</Note>

***

## Managing Access at Scale

### Bulk Grant Access

1. **Organization Settings** → **Members** → Select user
2. Click **Repository Access** tab
3. Select multiple repositories and set permission level
4. Grant access to all selected repositories

***

## Reviewing Access

### Audit Repository Access

Regularly review who has access:

1. Open repository → **Settings** → **Access**
2. Review all users and teams with access
3. Verify permission levels are appropriate
4. Remove users who no longer need access

### Access Reports

Generate access reports for compliance:

**Organization Settings** → **Reports** → **Access Report**

Shows:

* Who has access to which repositories
* Permission levels
* Last accessed date
* Access granted by whom and when

***

## Best Practices

* Enable repository access control for sensitive repos
* Use teams for easier management
* Grant least privilege: minimum required permission level
* Regular reviews: quarterly access audits
* Revoke promptly: remove access when no longer needed
* Monitor access logs: track who accesses what

***

## Troubleshooting

**User can't see repository**:

* Verify repository access control is enabled
* Check user has explicit repository access or team membership
* Organization Admins should always see all repositories

**User has wrong permission level**:

* Check both organization role and repository permission
* Effective access is combination of both

**Can't grant access**:

* Verify you have Admin access to the repository
* Only repository admins and org admins can grant access

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Roles and Permissions" icon="user-shield" href="/team/roles-and-permissions">
    Understand organization roles
  </Card>

  <Card title="Audit Logs" icon="clipboard-list" href="/team/audit-logs">
    Track access changes
  </Card>
</CardGroup>