This rule detects when the organization-level GitHub PAT access restriction is disabled, i.e., the event personal_access_token.access_restriction_disabled. When the restriction is active, classic and fine-grained PATs cannot access organization-owned resources; disabling it allows any member's PAT to access private repositories again, potentially enabling token-based persistence and data exfiltration after a breach. The detector relies on GitHub Audit Logs (logs-github.audit*) and surfaces the audit action event.action = "personal_access_token.access_restriction_disabled". Since this GitHub audit event covers both classic and fine-grained PATs, there is no separate per-type action to distinguish which PATs were affected; correlate with additional fields to determine scope (e.g., gh.org, gh.repo, github.hashed_token, github.token_scopes). The alert captures actor context (user.name, github.actor_ip, github.user_agent, github.programmatic_access_type), target organization/repo (github.org, github.repo), and token usage details (github.hashed_token, github.token_scopes). A legitimate, authorized change may occur during governance or maintenance, but unauthorized changes can indicate attacker takeover, token-based persistence, or data access. MITRE ATT&CK mappings include T1562 (Impair Defenses) with T1562.001 (Disable or Modify Tools) and T1484 (Domain or Tenant Policy Modification) as well as T1098 (Account Manipulation) under Persistence and Defense Evasion. False positives may arise from documented migrations off GitHub Apps, which should be time-bounded and owner-approved. Triage should verify the actor’s legitimacy, confirm whether the change was expected, and determine which PAT types were unrestricted. Review subsequent PAT grants and usage (token scopes, private repo activity) by the affected tokens. Remediation includes re-enabling the restriction, revoking potentially risky PATs, rotating credentials, auditing for related changes (owner adds, OAuth/App restrictions, IP changes), and hardening the PAT access policy across the organization (expiry, approval requirements for fine-grained PATs, and alerting on policy changes).