Git as the control plane for access management
GitHub manages access to more than 500 internal services, hundreds of GitHub.com organizations, and thousands of GitHub.com teams. The tool that makes that possible—Entitlements—is now available as an open source project. Built on the principle of using GitHub to build GitHub, Entitlements treats a Git repository as the source of truth for identity and access management (IAM), with all changes flowing through pull requests for review and approval.
Entitlements uses declarative authorizations stored in a Git repository, integrated with GitHub.com for approvals and audits. Because the configuration is version-controlled, every access request leaves a durable audit trail showing who requested it and who approved it. That repository-based model also makes the system self-service: anyone can open a pull request to add a user to an entitlement, obtain the required approvals, and deploy their own change without waiting on a central admin team.
Solving the classic IAM pain points
Auditability
Traditional access management relies on manual point-and-click grants that are difficult to track and prove in an audit. With Entitlements, the Git history records the entire lifecycle of an access change. The configuration supports metadata tags, so you can scan configs and automatically generate pull requests that force periodic re-approval of high-risk access. Expirations can also be set on entitlements, guaranteeing that access is revoked after a defined period.
Role changes and re-orgs
When teams restructure, employees often accumulate access from both their old and new roles. GitHub prevents this by pulling employee data from its internal source of truth and generating automatic groups per manager, region, level, and business function. Entitlements configurations reference these groups wherever possible, so when the org chart changes, group membership updates automatically—removing old access and provisioning new access in the same pass.
Scale and self-service
A centralized IAM team typically needs admin rights on every tool to fulfill requests, which doesn't scale. By putting entitlement changes in pull requests, Entitlements distributes the approval burden while keeping a small team in control. GitHub runs roughly 2,000 Entitlements commits per month through this model.
GitHub.com integrations for review and enforcement
Manager approval as a GitHub Action
Entitlements supports enforcing manager sign-off on every access change. A GitHub Action can parse the Entitlements diff, identify the affected users, and request review from each user's manager directly on the pull request.
This gives you a complete audit trail of the manager's approval and the subsequent deployment of access.
Periodic review for high-risk configurations
GitHub.com can also drive recurring audits of sensitive entitlements. A scheduled job checks each high-risk configuration for a metadata tag, parses the defined review date, and opens a pull request when that date is older than the review interval.
That forces re-approval of access and stores the justification in Git history. Combined with expirations, a high-risk entitlement that isn't re-approved can be automatically revoked.
Syncing from business data
Beyond static groups, you can wire Entitlements to a business data source of truth with a periodic job. When the org chart changes, the job pushes updates into the Entitlements configuration, and Entitlements handles the membership re-organization—de-provisioning and provisioning access as roles shift.
Getting started
The Entitlements App repository covers features and implementation details for running the system. For configuration examples and the workflows described above, see the Entitlements Config repository. GitHub has also open sourced two output plugins: entitlements-github-plugin and entitlements-gitrepo-auditor-plugin.
Entitlements is in production use at GitHub daily, and the project welcomes community contributions and feedback.
