Access Level Hierarchy
What Each Level Can Do
Organization-Level Access
If a repository belongs to an organization, organization owners and admins are treated as Admin on every repository in that organization — even repositories they were never invited to as a collaborator. This applies to every admin-gated operation, not just managing collaborators: things like obliterating files, editing branch protection, granular permissions, webhooks, and auto-lock / auto-release settings are all available to organization owners and admins on any repo in the org. If their direct repository access is already higher (unusual, since Admin is the top level), it is left as is. See Organization Management for how organization roles are assigned.Repository-Level vs Path-Level Access
Repository-level access is set when you invite a collaborator. This determines the maximum access level the user can have in the repository. Granular permissions access uses granular permissions to control access for specific files or folders. For example, you can give someone Write access to the repository but restrict them to Read-only on sensitive paths.Granular permissions only restrict access - they cannot grant higher access than the user’s repository-level permission. Once any granular permission rule exists in the repository, users without matching rules are denied all access by default.