Tier Zero Classification

Tier Zero (T0) identifies assets whose compromise grants control over the entire GitHub organization or the ability to compromise everything else. This is analogous to Active Directory Tier Zero, where Domain Controllers and Domain Admins are T0 because their compromise means full domain compromise. In GitHub, T0 classification serves two purposes:

1. Defensive prioritization — T0 assets should receive the highest level of protection, monitoring, and access review.
2. Attack path analysis — any attack path that reaches a T0 asset represents a critical finding, regardless of the number of hops.

​

The Two Dimensions of GitHub Tier Zero

​

Control Plane — Organizational Authority

Control plane T0 assets can reshape the access model itself. They don’t just have access to resources — they control who has access and how access is granted. This includes:

• Organization administration — managing members, teams, billing, security settings
• SSO/SCIM configuration — controlling authentication for all org members
• Role definition — creating or modifying custom organization and repository roles
• App management — installing or configuring GitHub Apps with arbitrary permissions

An actor with control plane authority can grant themselves (or anyone else) any level of access, making them effectively omnipotent within the organization.

​

Data Plane — Universal Repository Access

Data plane T0 assets have or cascade to admin access on every repository in the organization. Through the graph, this means they can reach:

• Every secret (via GH_HasSecret)
• Every branch (via GH_HasBranch → GH_CanWriteBranch)
• Every environment (via GH_HasEnvironment)
• Every cloud identity (via GH_CanAssumeIdentity)

The all_repo_admin synthetic role is the primary mechanism: the owners org role inherits it via GH_HasBaseRole, and it fans out via GH_AdminTo, GH_WriteRepoContents, GH_BypassBranchProtection, etc. to every repository.

​

T0 Asset Categories

​

Always T0

​

T0 by Relationship

​

Explicitly Not T0

​

Classification Rules

The classification rules are located in the extension/privilege_zone_rules directory of the OpenHound collector repository. Each rule is a Cypher query that returns nodes to be tagged as Tier Zero. See Privilege Zone Rules for the full list of queries.