> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/github/gh_parent.md).

# GH\_PARENT

## Summary

|                              |                                                                                                                            |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**      | GH\_PARENT                                                                                                                 |
| **Edge Type**                | Relationship                                                                                                               |
| **Affected Object Types**    | GitHub Organizations, GitHub Users, GitHub Teams, GitHub Repositories, GitHub App Installations, GitHub Organization Roles |
| **Exploitation Certainty**   | N/A (structural)                                                                                                           |
| **GitHub Role / Permission** | Enterprise / organization ownership / containment                                                                          |

## Description

`GH_PARENT` is a **structural containment** relationship: it records that a parent owns (contains) one of its child objects. Direction is always parent → child:

```
(GHEnterprise)-[GH_PARENT]->(GHOrganization)
(GHOrganization)-[GH_PARENT]->(GHUser | GHTeam | GHRepository | GHAppInstallation | GHOrgRole)
```

It covers every object that lives inside an enterprise or organization:

* **Enterprise → Org** — the organization belongs to the GitHub Enterprise account.
* **Org → User** — the user is a member of the organization.
* **Org → Team** — the team belongs to the organization.
* **Org → Repository** — the organization owns the repository.
* **Org → App Installation** — the GitHub App is installed in the organization.
* **Org → Org Role** — the (predefined or custom) role is defined within the organization.

This is the backbone of the enterprise → organization → object hierarchy. It is **not** a traversable attack path — being contained by an organization is not "control" over anything (a plain member does not control the org). The privileged relationships are modelled by separate edges (`GH_OWNER`, `GH_ADMIN`, `GH_MANAGE_ROLES`, etc.); `GH_PARENT` simply describes where each object sits.

## Identification

### GitHub Web Interface

In the enterprise account, **Settings → Organizations** lists every org owned by the enterprise (each is a child via `GH_PARENT`). Within an organization, browse **People** (users), **Teams**, **Repositories**, **Installed GitHub Apps**, and **Organization roles** — every listed object is a child of the org via `GH_PARENT`.

### GitHub CLI

```bash
gh api "enterprises/{enterprise}/org-properties/values" --paginate --jq '.[].organization_login'
gh api "orgs/{org}/members" --paginate --jq '.[].login'
gh api "orgs/{org}/teams" --paginate --jq '.[].slug'
gh api "orgs/{org}/repos" --paginate --jq '.[].full_name'
gh api "orgs/{org}/installations" --jq '.installations[].app_slug'
gh api "orgs/{org}/organization-roles" --jq '.roles[].name'
```

## Exploitation

Not applicable — `GH_PARENT` is a structural containment relationship, not a traversable attack path. It is excluded from shadow-admin path-finding for exactly this reason.

## Mitigation

Not applicable directly. Containment is inherent to the organization. Manage the *privileged* relationships layered on top of it (ownership, admin, role management) rather than `GH_PARENT` itself.

## References

* <https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/about-organizations>