GitHub App least privilege for SaaS repo creation and access

A SaaS product may need to create a customer repository during onboarding, or add an existing repository to an already installed GitHub App. Those are legitimate product workflows, but asking a custom