# Repository boundaries belong in the permission model

> Access should be a property of the repository graph, not a policy document. How scoped invitations and bot grants stay auditable over time.

Published: 2026-04-24
Author: Alan (Co-Founder)
Tags: Security, Permissions

Every team eventually writes the document that explains who is allowed to touch what. Very few teams manage to keep it true.

## Encode it, do not describe it

An invitation in Trylle carries its scope: which repositories, which permission level, and when it expires. Revoking it removes the access immediately rather than adding a line to a spreadsheet that someone will act on later.

## Bots follow the same rules

Automations and bots are subject to the same grants as people. A bot cannot read a repository that was never connected to its workspace, and every grant it holds is visible on the same access page as human collaborators.

---

Canonical: https://blog.trylle.com/repository-boundaries-belong-in-the-permission-model