docs/data/reusables/actions/workflows/github-token-access.md

1. Under "Workflow permissions", choose whether you want the GITHUB_TOKEN to have read and write access for all scopes (the permissive setting), or just read access for the contents {% ifversion actions-default-workflow-permissions-restrictive %}and packages scopes{% else %}scope{% endif %} (the restricted setting).