> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/remediation-agents/code-agent/setting-up-ai-guardian/connecting-to-github/github-fine-grained-personal-access-token-required-permissions.md).

# GitHub Fine-Grained Personal Access Token - Required Permissions

This page defines the process to create GitHub Access Token and the minimum GitHub fine-grained personal access token (PAT) permissions required for Delivery Shield's automated remediation workflow, including branch creation, committing changes, and opening pull requests.

### To Create a GitHub Access Token <a href="#user-content-how-to-create-a-github-access-token" id="user-content-how-to-create-a-github-access-token"></a>

Follow the steps below to generate a **Fine-Grained Personal Access Token** in GitHub:

1. **Click on your profile icon** (top-right corner) and select **Settings**.

<figure><img src="https://591284771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDmLTMQiowMHZ4CQPCvT%2Fuploads%2FV0nKUxDz3PFESrxEDA5O%2Fimage.png?alt=media&amp;token=6974d835-6b13-40f4-bfbd-5558abd7c9a0" alt="" width="154"><figcaption></figcaption></figure>

2. Scroll down in the left sidebar and click **Developer settings**.

<figure><img src="https://591284771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDmLTMQiowMHZ4CQPCvT%2Fuploads%2FHw6V1EIz1thmAPk8N3Ga%2Fgithub.png?alt=media&amp;token=fe3f1314-77a1-4c8f-96c0-a71a33d3730b" alt=""><figcaption></figcaption></figure>

3. Under **Personal access tokens**, select **Fine-grained tokens**.

<figure><img src="https://591284771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDmLTMQiowMHZ4CQPCvT%2Fuploads%2FuWn1tIL722gte1stkOCM%2Ffine%20token.png?alt=media&amp;token=26a620d0-1f1b-47cb-a058-3703bdb4aaad" alt=""><figcaption></figcaption></figure>

4. Click **Generate new token**.
5. Fill in the token details:
   1. **Token name** — Give it a descriptive name
   2. **Resource owner** — Select the appropriate owner (your account or an organization)
   3. **Expiration** — Choose an expiration period

<figure><img src="https://591284771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDmLTMQiowMHZ4CQPCvT%2Fuploads%2FbJI8eCbH9wM3a49oMHwP%2Fdetails.png?alt=media&amp;token=70ad034b-6790-4fdf-a524-c1265a69a9b0" alt=""><figcaption></figcaption></figure>

6. Under **Repository access**, select the repository or repositories this token should apply to.
7. Configure the required **Permissions** for the token.
8. Click **Generate token**.

<figure><img src="https://591284771-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxDmLTMQiowMHZ4CQPCvT%2Fuploads%2FAfap0GSeXFZGfGFtjT3x%2Ftoken.png?alt=media&amp;token=cb83cab2-16fb-4e44-b37b-08cfa0ffe8f3" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Copy and save your token immediately — GitHub will not show it again after you leave the page.
{% endhint %}

### Required Permissions:

The following permissions are required in Delivery Shield.&#x20;

| **Permission** | **Access Level**     | **Purpose**                                                                                                                                                              |
| -------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Contents       | Read and write       | Required to create branches and commit remediation changes to the repository.                                                                                            |
| Pull requests  | Read and write       | Required to open and manage pull requests for remediation changes.                                                                                                       |
| Metadata       | Read Only (required) | Mandatory baseline permission auto-included by GitHub on every fine-grained PAT; grants repository search, collaborator listing, and metadata access. Cannot be removed. |

#### Notes

* The permissions mentioned above are sufficient for the remediation workflow end-to-end — no additional scopes are required.
* The token must be scoped to **Only select repositories** and explicitly include each target repository.