Keep the bypass list short and specific: a security or release team, not all admins, and never the whole engineering group. Grant it by team or app, require a reason each time, and review every use afterward. A gate everyone can bypass is a suggestion.
What GitHub rulesets allow
GitHub's documentation says rulesets can let certain actors skip their rules. Bypass access can be granted by role, such as repository administrator, or to specific teams or GitHub Apps. It also says you can change a ruleset's enforcement status without deleting the ruleset, and that bypass for push rulesets on forks comes from the root repository.
Layering matters too. Rulesets have no priority. Rules from several rulesets targeting the same branch are aggregated, and where a rule differs, the most restrictive version applies. They also layer with branch protection rules, and all applicable rules are enforced.
Who belongs on the list
| Candidate | Include? | Reason |
|---|---|---|
| On call release manager | Yes | Needs to ship a hotfix at 3 am |
| Security team | Yes | Owns the policy and the exception review |
| A deployment bot | Maybe | Only if its action is itself reviewed |
| All repository admins | Usually no | Too broad, many people hold the role |
| The author of the change | No | Self approval defeats the point |
Rules for a healthy bypass
- Use a team, so membership changes in one place.
- Keep two to five people on it, with a named backup.
- Require a ticket or incident reference every time.
- Alert a channel automatically when a bypass is used.
- Review each use within a business day and record the outcome.
- Reconcile the list quarterly and remove anyone who has not needed it.
Bypass is not the same as an exemption
An exemption changes what the gate checks for a specific finding, with an expiry. A bypass skips the gate for one merge. Use exemptions for known, accepted risks and keep bypass for emergencies. If bypass is common, the gate or the process is wrong.
What to track
Count bypasses per month and the reasons given. A pattern, such as the same repository every week, points to a gate that needs fixing. A bypass followed by a fix within a day is healthy. One followed by silence is not.
Quick check
Should repository admins always be able to bypass?
Not by default. Admin roles are often broad. Prefer a small named team.
What if two rulesets disagree?
Per GitHub, rules are aggregated and the most restrictive version applies.
Safeguard's policies, gates and guardrails can record who approved an override, which supports an audit trail. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
