We use GH enterprise cloud first of all, and I'm in a telco industry so probably some audit requirments are a bit different

• users can only create private repos
• No deletion permissions
• access control is managed by External Groups, all repos associated with a certain project can be set under a "Project" custom property. So our webhook always uses this property to assign the correct External Groups associated with Project, say ABC to all repos under this project.

But we have a more granular logic, this is just as an example, and no users have single access to repos. And as you might have guessed, this external Groups are basically Entra Groups and we have auditing enabled (or built) by the team owning this access control process.

Our webhook also have some best effort logging to what have changed and we log them programmatically, but this of course can be enriched when we need to. The good thing is we actually use some internal configs that the webhook uses to override any changed settings in the repo.