This rule detects the enabling of automatic approval for fine-grained personal access token (PAT) requests in a GitHub organization. It watches the GitHub audit log data stream (logs-github.audit-*) for the event action auto_approve_personal_access_token_requests.enable. When this setting is turned on, members’ PAT requests bypass the owner-review gate, granting immediate, potentially long-lived, organization-scoped access. An adversary who gains owner privileges could enable auto-approval to facilitate persistence and broad data access without triggering owner reviews. The rule surfaces fields such as user.name, github.org, github.repo, github.actor_ip, github.hashed_token, github.programmatic_access_type, and github.user_agent to aid investigation. It aligns with MITRE ATT&CK techniques under Defense Evasion (Impair Defenses, Domain or Tenant Policy Modification) and Persistence (Account Manipulation with Additional Cloud Credentials). The rule has a risk_score of 47 and is categorized as medium severity. The investigation guide (and linked references) emphasize validating whether the change was policy-sanctioned or requires follow-up actions to restore controls.