Tier Zero (T0) identifies assets whose compromise grants control over the entire GitHub organization or the ability to compromise everything else. This is analogous to Active Directory Tier Zero, where Domain Controllers and Domain Admins are T0 because their compromise means full domain compromise.
In GitHub, T0 classification serves two purposes:
- Defensive prioritization — T0 assets should receive the highest level of protection, monitoring, and access review.
- Attack path analysis — any attack path that reaches a T0 asset represents a critical finding, regardless of the number of hops.
The Two Dimensions of GitHub Tier Zero
Control Plane — Organizational Authority
Control plane T0 assets can reshape the access model itself. They don’t just have access to resources — they control who has access and how access is granted. This includes:- Organization administration — managing members, teams, billing, security settings
- SSO/SCIM configuration — controlling authentication for all org members
- Role definition — creating or modifying custom organization and repository roles
- App management — installing or configuring GitHub Apps with arbitrary permissions
Data Plane — Universal Repository Access
Data plane T0 assets have or cascade to admin access on every repository in the organization. Through the graph, this means they can reach:- Every secret (via
GH_HasSecret) - Every branch (via
GH_HasBranch→GH_CanWriteBranch) - Every environment (via
GH_HasEnvironment) - Every cloud identity (via
GH_CanAssumeIdentity)
all_repo_admin synthetic role is the primary mechanism: the owners org role inherits it via GH_HasBaseRole, and it fans out via GH_AdminTo, GH_WriteRepoContents, GH_BypassBranchProtection, etc. to every repository.
T0 Asset Categories
Always T0
T0 by Relationship
Explicitly Not T0
Classification Rules
The classification rules are located in thepz-rules/ directory. Each rule is a Cypher query that returns nodes to be tagged as Tier Zero. See Privilege Zone Rules for the full list of queries.