# Enabling delegated bypass for push protection
Control who can push code containing secrets by requiring bypass approval from designated reviewers.
Delegated bypass for push protection lets you define who can push commits containing secrets and adds an approval process for other contributors. See [Delegated bypass for push protection](/en/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/delegated-bypass-for-push-protection/about-delegated-bypass-for-push-protection).
To enable delegated bypass, create the teams or roles that will manage bypass requests. Alternatively, use fine-grained permissions for more granular control. See [Using fine-grained permissions to control who can review and manage bypass requests](#using-fine-grained-permissions-to-control-who-can-review-and-manage-bypass-requests).
## Enabling delegated bypass for a repository
> \[!NOTE]
> If an organization or enterprise owner configures delegated bypass at the organization or enterprise level, the repository-level settings are disabled.
1. On GitHub, navigate to the main page of the repository.
2. Under your repository name, click ** Settings**. If you cannot see the "Settings" tab, select the **** dropdown menu, then click **Settings**.
3. In the "Security" section of the sidebar, click ** Advanced Security**.
4. Under "Secret Protection," ensure that push protection is enabled for the repository.
5. Under "Push protection," to the right of "Who can bypass push protection for secret scanning," select the dropdown menu, then click **Specific roles or teams**.
6. Under "Bypass list," click **Add role or team**.
7. In the dialog box, select the roles and teams that you want to add to the bypass list, then click **Add selected**.
> \[!NOTE]
> You can't add secret teams to the bypass list.
8. Optionally, to fully exempt the actors from push protection, to the right of the actors' details, select , then click **Exempt**.
> \[!WARNING]
> Push protection exemptions are designed for trusted automation that needs to push many commits with minimal friction. Exemptions may lead to leaked secrets, and should be granted with caution.
## Enabling delegated bypass for an organization
1. On GitHub, navigate to the main page of the organization.
2. Under your organization name, click ** Settings**. If you cannot see the "Settings" tab, select the **** dropdown menu, then click **Settings**.
3. In the "Security" section of the sidebar, select the ** Advanced Security** dropdown menu, then click **Configurations**.
4. Create a new custom security configuration, or edit an existing one. See [Creating a custom security configuration](/en/code-security/securing-your-organization/enabling-security-features-in-your-organization/creating-a-custom-security-configuration#creating-a-custom-security-configuration).
5. When defining the custom security configuration, under "Secret scanning," ensure that "Push protection" is set to **Enabled**.
6. Under "Push protection," to the right of "Bypass privileges," select the dropdown menu, then click **Specific actors**.
7. Select the **Select actors** dropdown menu, then choose the actors you want to add to the bypass list.
> \[!NOTE]
>
> * You can't add secret teams to the bypass list.
> * In addition to assigning bypass privileges to roles and teams, you can also grant *individual* organization members the ability to review and manage bypass requests using fine-grained permissions. See [Using fine-grained permissions to control who can review and manage bypass requests](#using-fine-grained-permissions-to-control-who-can-review-and-manage-bypass-requests).
8. Optionally, to fully exempt the actors from push protection, to the right of the actors' details, select , then click **Exempt**.
> \[!WARNING]
> Push protection exemptions are designed for trusted automation that needs to push many commits with minimal friction. Exemptions may lead to leaked secrets, and should be granted with caution.
9. Click **Save configuration**.
10. Apply the security configuration to repositories in your organization. See [Applying a custom security configuration](/en/code-security/securing-your-organization/enabling-security-features-in-your-organization/applying-a-custom-security-configuration).
## Enabling delegated bypass for an enterprise
1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec\&ref_type=engagement\&ref_style=text) page on GitHub.com.
2. At the top of the page, click **Settings**.
3. In the left sidebar, click ** Advanced SecurityCode security**.
4. In the "Security" section of the sidebar, select the ** Advanced Security** dropdown menu, then click **Configurations**.
5. Create a new custom security configuration, or edit an existing one. See [Creating a custom security configuration for your enterprise](/en/enterprise-cloud@latest/admin/managing-code-security/securing-your-enterprise/creating-a-custom-security-configuration-for-your-enterprise).
6. Under **Secret scanning**, ensure **Push protection** is enabled.
7. Under "Push protection," to the right of "Bypass privileges," select the dropdown menu, then click **Specific actors**.
> \[!NOTE]
> You can't add secret teams to the bypass list.
8. Select the **Select actors** dropdown menu, then choose the actors you want to add to the bypass list.
9. Optionally, to fully exempt the actors from push protection, to the right of the actors' details, select , then click **Exempt**.
> \[!WARNING]
> Push protection exemptions are designed for trusted automation that needs to push many commits with minimal friction. Exemptions may lead to leaked secrets, and should be granted with caution.
10. Click **Save configuration**.
11. Apply the security configuration to organizations and repositories in your enterprise. See [Applying a custom security configuration to your enterprise](/en/code-security/how-tos/secure-at-scale/configure-enterprise-security/establish-complete-coverage/applying-a-custom-security-configuration-to-your-enterprise).
## Using fine-grained permissions to control who can review and manage bypass requests
You can grant specific individuals or teams in your organization the ability to review and manage bypass requests using fine-grained permissions.
1. Ensure that delegated bypass is enabled for the organization. For more information, follow steps 1-3 in [Enabling delegated bypass for your organization](/en/code-security/secret-scanning/using-advanced-secret-scanning-and-push-protection-features/delegated-bypass-for-push-protection/enabling-delegated-bypass-for-push-protection#enabling-delegated-bypass-for-an-organization) and ensure you have saved and applied the security configuration to your selected repositories.
2. Create (or edit) a custom organization role. For information on creating and editing custom roles, see [Managing custom organization roles](/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-organization-roles#creating-a-custom-role).
3. When choosing which permissions to add to the custom role, select the "Review and manage secret scanning bypass requests" permission.
4. Assign the custom role to individual members or teams in your organization. For more information on assigning custom roles, see [Using organization roles](/en/organizations/managing-peoples-access-to-your-organization-with-roles/using-organization-roles#assigning-an-organization-role).