Skip to main content
Each runner profile can declare an Access Level that controls which Namespace features the runner workload is allowed to use at runtime. Access levels apply on top of any explicit workload permissions configured on the workspace, and let you tighten what a particular runner can do without changing your workspace defaults. Access Level is a profile-only setting and is configured in the runner profile editor under Advanced Settings. Three levels are available:
  • Permissive (default): the runner workload uses the workspace’s standard Namespace permissions. This is the historical behavior and the right choice for most profiles.
  • Limited: the runner workload is restricted to the features needed by GitHub Actions jobs, including remote builders, the container registry, the cache service, and federated tokens. Other Namespace APIs are not reachable from the runner.
  • Restricted: Namespace feature access is disabled for the runner workload. Use this for jobs that should not be able to call any Namespace APIs from inside the runner (for example, when running fully untrusted third-party code).
If no access level is selected, profiles default to Permissive.

​
Next steps

Last modified on September 15, 2026