Reference D: Ownership model comparison

This reference compares the shared Cortex GitHub App and the Customer Owned GitHub App in detail. Both ownership models provide the same scanning and remediation capabilities, but they request different permissions sets and differ in how the GitHub App is created, who owns the resulting GitHub App, and who controls the GitHub App after onboarding. The shared Cortex GitHub App requests the permissions in Reference A; a Customer Owned GitHub App requests those permissions plus the additional organization-level and identity permissions in Reference B.

Why choose a Customer Owned GitHub App

A Customer Owned GitHub App addresses the limitations of authenticating every tenant through a single shared GitHub App. A Customer Owned GitHub App delivers the following outcomes:

• Tenant isolation: Each tenant authenticates through a dedicated GitHub App. A misconfiguration or compromise of one GitHub App does not affect other customers
• Customer ownership. The GitHub App appears in your own GitHub organization settings. Your organization administrators can view, manage, and revoke the GitHub App independently, rather than trusting a third-party app
• Permission control: Because your organization owns the GitHub App, you can adjust the GitHub App permissions to meet stricter or more permissive access requirements
• Organization policy compatibility: Organizations that block third-party GitHub App installations, or that require apps to be owned by the organization, can onboard GitHub Cloud repositories that the shared Cortex GitHub App could not access
• Audit and compliance visibility: Security-conscious organizations get full visibility into the GitHub App that accesses their repositories and can revoke that access on their own terms

Creation mechanism

The two ownership models use different GitHub-side creation mechanisms, even though both start from the same Cortex Cloud onboarding wizard.

Aspect	Cortex GitHub App	Customer Owned GitHub App
GitHub-side flow	Install and authorize a GitHub App that already exists (cas-cortex)	Create a new GitHub App in your organization from the Cortex Cloud manifest (GitHub App Manifest Flow)
What GitHub creates	A new installation of the existing shared GitHub App	A new GitHub App object in your organization, plus an installation of that GitHub App.
Where you complete the flow on GitHub	The GitHub install and authorize screen	The GitHub app creation page, then the installation screen
GitHub App credentials	Held by Palo Alto Networks	Generated during creation (app ID, client ID, client secret, PEM key, webhook secret) and stored by Cortex Cloud, encrypted and scoped to your tenant

Permissions

The two ownership models request different permission sets. Both cover the same scanning and remediation capabilities; the Customer Owned GitHub App additionally requests organization-level and identity permissions.

Aspect	Cortex GitHub App	Customer Owned GitHub App
Permission set	Repository-level permissions only. See Reference A: Shared Cortex GitHub App permissions	Repository-level permissions plus organization-level and identity permissions. See Reference B: Customer Owned GitHub App permissions
Permission modification after onboarding	Not available. permissions are fixed by Palo Alto Networks	Available. You can tighten or loosen the GitHub App permissions in your GitHub App settings
Additional permissions requested	None beyond Reference A	emails, members, organization_actions_variables, organization_administration, organization_hooks, organization_secrets, organization_self_hosted_runners, organization_user_blocking

Ownership and isolation

The manifest sets the initial state of a Customer Owned GitHub App, but the resulting GitHub App objects live in different places and have different isolation properties.

Aspect	Cortex GitHub App	Customer Owned GitHub App
GitHub App owner	Palo Alto Networks	Your GitHub organization
GitHub App object	One shared GitHub App object, installed into many tenants	A dedicated GitHub App object per tenant, created in your organization
Isolation	A misconfiguration or compromise of the shared GitHub App affects every customer installed into it	A misconfiguration or compromise of your GitHub App affects only your organization
Visibility in your GitHub organization	Appears as a third-party app you install	Appears as a private app your organization owns, in your organization GitHub App settings

Post-onboarding control

The configuration manifest sets the initial state of a Customer Owned GitHub App. After onboarding, control of the GitHub App diverges between the two ownership models.

Capability after onboarding	Cortex GitHub App	Customer Owned GitHub App
Change GitHub App permissions	Not available — permissions are fixed by Palo Alto Networks	Available — you can tighten or loosen the GitHub App permissions in your GitHub App settings
Revoke access independently	Available only by uninstalling the shared GitHub App	Available — you control the GitHub App and can revoke access on your own terms
Onboard when organization policy blocks third-party apps	Not available	Available — the GitHub App is owned by your organization
Risk of permission drift from the manifest	None — Palo Alto Networks maintains the shared GitHub App	Present — if you downgrade pull_requests: write or contents: write, fix pull request creation is blocked