Minimum GitHub PAT scopes for agent PR work

Domain: github · Evidence E0 — Contributor self-reported

githubpatscopessecuritypragent

Summary

Agent cannot push to a fork or open PRs; or a PAT is over-scoped (`admin:org`) and risky if leaked.