Organization owners can set three token policies: whether classic and fine-grained tokens may reach organization resources, a maximum lifetime for fine-grained tokens, and whether an owner must approve each fine-grained token. Both token types are enabled by default, and classic tokens have no approval step.
The three levers
| Policy | What it does | Default |
|---|---|---|
| Access restriction | Restrict or allow tokens reaching organization resources | Both token types enabled |
| Maximum lifetime | Caps fine-grained token life | 366 days; classic has no expiry requirement |
| Approval | Owner approves each fine-grained token | Require administrator approval |
Tokens can still read public organization resources under any setting. SSH keys created by restricted tokens keep working, so keys need their own review.
What the policies leave open
Non-compliant tokens belonging to members are blocked, not revoked or disabled. Classic tokens are not subject to approval, so unless you restrict them they can reach organization resources without any owner decision.
The practical reading: if you want owner visibility, prefer fine-grained tokens and consider restricting classic ones.
Set it up
- Open your profile menu, choose Organizations, and select the organization.
- Open Settings, then Personal access tokens, then Settings.
- On the Fine-grained tab, choose the access policy, set the maximum lifetime and pick the approval option. Save each.
- On the Tokens (classic) tab, choose to allow or restrict, and save.
Owner created tokens do not need approval, which is a reason to keep the owner list small.
A rollout order that avoids outages
- Review active tokens first, so you know what depends on them.
- Announce the date and the new rule: fine-grained tokens, short lifetime, approval required.
- Move automation to GitHub App installation tokens where practical, since those expire after an hour.
- Restrict classic tokens last, after services have moved.
- Add the policy to onboarding and the quarterly access review.
Expect questions about tokens used by build servers. Treat each as a small migration, not an exception. Keep a short register of tokens that are approved to stay long lived, with an owner and a review date, so the exceptions stay visible instead of becoming the norm.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the monitoring demo and imagine the same alert feed for token creation and approval requests in your org.
Click through it at your own pace, or open it full screen.
Quick check
Do classic tokens need approval?
No. GitHub says classic tokens are not subject to approval; restrict them if you want them blocked.
What is the default fine-grained maximum lifetime?
366 days.
Sources
- Setting a personal access token policy for your organization (GitHub Docs)
- Best practices for creating a GitHub App (GitHub Docs)
Last reviewed: 19 October 2026.
