Play / The map / The capabilities / Push to a code host (any branch it can reach)
Push to a code host (any branch it can reach)
write.repository.tenant — write × repository at tenant reach (the organisation's accounts, repositories and services). Family: code. Effect: recoverable from a backup, a history or a revert, at a cost.
Granted by 4 of 9
| Profile | Control on the path | Evidence | Via |
|---|---|---|---|
| Claude Code — web container | ◐ setting | observed | shell (Bash), harness (MCP and built-in tools) |
| Claude Code — local · confirm off | ◉ expectation | derived | shell (Bash) |
| Claude Code — local · confirm on | ◉ expectation | derived | shell (Bash) |
| Claude.ai — connectors on | ○ boundary | derived | connectors |
What narrows it
The setting: a branch protection rule at the host — the agent cannot edit it — and a pre-push hook in the clone for the earlier, cheaper refusal
What it costs: minutes; and a review step before anything deploys
Tier after: boundary (host rule) · setting (hook)
Questions that ask about it
- Does it push commits to a code host? — eliciting, reliability 0.7
In the mandates
- wanted by A coding assistant in a container on the web
- wanted by A CI job on a hosted runner
- not wanted by Chat, with connectors switched on
- not wanted by Chat in the browser, nothing connected