> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/glossary/github-glossary.md).

# GitHub Glossary

GitHub Glossary

The glossary explains how GitHub identities, teams, roles, and configurations are classified, how high-impact identities are identified, and how privilege levels affect security within GitHub environments.

***

### GitHub Objects

Forestall ISPM analyzes the following identity and configuration objects within GitHub environments.

* Users
* Teams
* Repositories
* Organization Roles
* App Installations
* Organizations
* Enterprises

***

### Tier 0 (GitHub)

#### What "Tier 0" Means in GitHub

Tier 0 identities in GitHub represent control over the entire GitHub organization or enterprise and its identity control plane. Any identity, team, or role that can manage membership, authorization, role assignments, or security settings at the organization or enterprise level is considered Tier 0.

Compromise of a Tier 0 identity can result in full control over users, teams, repositories, organization roles, and configurations within the organization or enterprise.

For this reason, Tier 0 identities must be tightly protected and managed only through secure administrative access by the most-trusted administrators.

#### Which GitHub Objects Are Always Tier 0

The following GitHub objects are always considered Tier 0 due to their ability to control the organization-wide or enterprise-wide identity and security boundary.

* The GitHub Enterprise account
* The GitHub Organization itself
* Users assigned the organization **Owner** role
* Enterprise owners
* Organization roles that grant the built-in **admin** base role (e.g., organization owner, all-repository administrator)
* App installations granted organization administration permissions

#### How GitHub Objects Get Their Tier

In GitHub environments, the tier of an object is determined by the scope of permissions, role and team assignments, and relationships to Tier 0 identities.

Objects that are not inherently Tier 0 can become Tier 0 or Privileged through direct or indirect role assignments, team memberships, nested team hierarchies, or control over Tier 0 identities.

Forestall determines the effective tier of GitHub objects by analyzing organization and repository permissions, organization role definitions, team membership and maintainer relationships, and privilege chains during GitHub scans.

***

### Privileged (GitHub)

Privileged objects in GitHub are identities, teams, or roles that have high-impact permissions over GitHub resources or security controls, but do not represent full organization-level control.

These objects can significantly affect users, teams, repositories, or security settings and may be leveraged to indirectly compromise Tier 0 identities.

Forestall marks the following types of objects as Privileged in GitHub environments:

* Users or teams holding high-impact organization roles (e.g., **security-manager**)
* Identities that can manage members, teams, or organization security configurations
* Teams or users with administrative permission over many repositories
* App installations with write or administrative permissions across repositories
* Objects with permissions that can modify privileged identities, teams, or roles

***

### Unprivileged (GitHub)

Unprivileged objects in GitHub are identities and teams that do not have elevated administrative permissions and cannot directly or indirectly compromise Tier 0 or Privileged objects.

These objects typically have limited scope and impact within the GitHub environment.

All GitHub objects that are not classified as Tier 0 or Privileged are considered Unprivileged by Forestall.

***

### Shadow Admin (GitHub)

Shadow Admin objects in GitHub are identities, teams, or roles that are not explicitly classified as Tier 0 or Privileged, but can indirectly compromise Tier 0 identities or gain high-impact control through role assignments, team hierarchies, or privilege escalation paths.

These objects may enable privilege escalation paths that result in organization-level or enterprise-level impact without being immediately obvious as administrative identities.

Forestall identifies GitHub Shadow Admins by analyzing organization and repository permissions, organization role definitions, team membership and maintainer relationships, and indirect control paths within the GitHub environment.