For most contractors, make them outside collaborators on GitHub, not organization members. An outside collaborator can reach only the repositories you grant, and your organization base permissions do not apply to them. Members inherit base access and can see more of your organization than a short engagement needs.
What the two labels mean
An organization member belongs to your GitHub organization. They can be added to teams, they see the organization member list, and they pick up the base permission you set for every member.
An outside collaborator is someone who is not a member but has been given access to one or more specific repositories. GitHub's documentation states that base permissions do not apply to outside collaborators, and that outside collaborators cannot be added to a team because team membership is limited to organization members.
That second point has a practical effect. You cannot hand a contractor access by dropping them into your "backend" team and forgetting about it. Every grant is explicit and per repository, which is exactly what you want for someone who is here for ten weeks.
Member or outside collaborator: a side by side
| Question | Organization member | Outside collaborator |
|---|---|---|
| Gets org base permission | Yes | No |
| Can join teams | Yes | No |
| Sees all org members and teams | Yes | No |
| Access scope | Base plus teams plus direct grants | Only repositories you name |
| Fits a long term employee | Yes | Rarely |
| Fits a fixed term contractor | Only with a reason | Usually |
The table reflects the behavior GitHub documents when you convert a member to an outside collaborator: they lose team membership, lose the ability to see all organization members and teams, and can no longer create teams.
Steps to set it up
- Set your base permission to the lowest level that your staff can live with, so members do not quietly hold write access everywhere.
- Invite the contractor to the one repository they need, at the lowest role that lets them do the job (see the role guide linked below).
- Require two-factor authentication at the organization level. GitHub states that outside collaborators without 2FA are removed when you turn the requirement on, so warn them first.
- Decide who may invite outside collaborators. By default anyone with admin on a repository can. On plans that support it, you can limit this to organization owners.
- Write the end date next to the grant in your own tracker. GitHub does not expire the invitation for you, which is why contractor access never expires unless someone owns the date.
When a member label is the better call
Some engagements are really staff in all but name: a long embedded engineer who needs team review requests, CODEOWNERS routing, and wide read access. A member account may be simpler there. If you go that way, convert them to an outside collaborator at the end rather than deleting them, since GitHub keeps a converted person's membership privileges for three months in case they return. Then check their direct repository grants, because conversion leaves access they were given directly or through former teams in place until you review it.
What this setting does not do
Labels do not limit what a contractor can do inside a repository they can write to. Branch rules, required review, and environment approvals do that. Pair this choice with the controls in branch protection rules worth enabling and the contractor offboarding checklist.
Safeguard's asset discovery and policy gates can help you see which repositories exist and enforce checks on every pull request, including those from external developers. See the free scan at gold.safeguard.sh/scan.
Quick check
Do base permissions apply to outside collaborators?
No. GitHub's documentation says base permissions apply to organization members and not to outside collaborators, so each repository grant for a contractor is explicit.
Can I put an outside collaborator on a team?
No. Team membership is restricted to organization members, so contractors are granted access repository by repository.
Sources
- Adding outside collaborators to repositories in your organization
- Setting base permissions for an organization
- Converting an organization member to an outside collaborator
- Requiring two-factor authentication in your organization
Last reviewed: 19 October 2026.
