GitHub Personal Access Tokens have no granular permissions. Coworkers always opt-in to use PATs instead of deploy keys, because it's easier, but to be able to c

GitHub Personal Access Tokens have no granular permissions. Coworkers always opt-in to use PATs instead of deploy keys, because it's easier, but to be able to clone a repo with PAT you need to extend the permissions way beyond just cloning a repo. The OAuth scopes are also not very granular. They don't have to reinvent the wheel - there are already a bunch of working systems they just need to replicate.