Access levels
The four Gitfence access levels, how rules combine, and what restricted people and AI agents can read, edit or never receive.
Short answer: Every path has one of four levels for each access group or person. A restricted clone contains only the files allowed by those levels, and hidden files are absent from every commit in it.
The four levels
| Level | What the person gets |
|---|---|
| No access | Nothing. The path is absent from every commit in their clone, including history. |
| Types only | The API without the implementation: TypeScript declarations, or Go and Python stubs at the same path, with every value removed. Their code can import, build and type-check against it, but the source is not there and cannot be edited. See Types only. |
| Can read | The source, read-only. A push that changes it is refused. |
| Can edit | The source, writable. Their changes arrive on GitHub as pull requests. |
How rules apply
- A rule on a folder applies to everything inside it. A rule on a file or subfolder inside that folder overrides it.
- Groups hold the main rules. An exception gives one person a different level on one path on top of their group.
- Preview as shows exactly what a group or person would receive before you save.
- A person is restricted when at least one folder is below Can edit for them. Full-access teammates are not restricted and do not count as seats.
Always-on protections
Some protection applies to every restricted copy, whatever the rules say:
- Secrets files are hidden:
.env*files (except examples),*.pem,*.key, SSH private keys,*.tfvars,*.tfstate, cloud credential files and similar. Only a rule that names the exact file can open one. - Recognised credential values inside other files are replaced with a stand-in before the file is served.
.github/**,.gitlab-ci.yml,.circleci/**,.gitattributes,.gitmodulesand.gitfence.ymlstay read-only unless a rule explicitly grants writing inside them.- A folder marked No AI agents is hidden from every agent token, even when the person can read it.
AI agents
An agent belongs to a person and can never have more access than that person. An agent's own scope only narrows: for every path, Gitfence applies the stricter of the person's access and the agent's scope.
Gotchas
- Types only works for TypeScript, Go and Python. Other files under a types-only folder are hidden.
- Hidden code is not in their clone, but it can still reach them through a review comment, a test result or a person's message. Gitfence redacts what it relays.
- Code someone already cloned cannot be taken back by changing a level. It affects what they receive on their next pull.
Next: Types only, the access ladder and AI agents and MCP.
Related guides
- Getting startedSet up Gitfence for your organization: create it, connect GitHub, add a repository, restrict folders and invite your first contractor.
- The access ladderGive a new hire or contractor a ladder: their area first, more access after 30 and 90 days, and an end date, with each step approved by you.
- AI agents and MCPGive Claude Code, Codex or Cursor an agent token and connect the MCP server. Scopes, tools, run_tests availability and the guide in every clone.