Prevent unapproved GitHub charges

openwiki/gh-settings.md

@@ -20,7 +20,9 @@ metadata, and canonical governance standard. It has no executable runtime.
 
 Use the [skill](../plugins/gh-settings/skills/sync/SKILL.md) for task scope and the
 [standard](../plugins/gh-settings/skills/sync/references/standard.md) for team
-policy. The standard covers scope and authority, security profiles, dependency
+policy. For free-feature and cost-control requests, read the standard's
+[Prevent Additional Charges](../plugins/gh-settings/skills/sync/references/standard.md#prevent-additional-charges)
+section. The standard covers scope and authority, security profiles, dependency
 submission, Dependabot defaults, rulesets, merge policy, other settings, and
 reconciliation. Load the sections relevant to the requested profile; a complete
 governance audit uses the whole standard.

plugins/gh-settings/skills/sync/SKILL.md

@@ -10,6 +10,10 @@ scope and authority sections plus the controls needed for the requested profile;
 read the full standard for a comprehensive governance audit. Check current
 GitHub documentation for control availability and billing.
 
+For free-feature or cost-control requests, also read the standard's
+`Prevent Additional Charges` section. Preventing unapproved charges is an
+acceptance condition, not a conclusion from feature toggles alone.
+
 Organization-wide work puts controls at the highest sufficient authorized scope.
 Repository-scoped work keeps parent state read-only. Preserve the distinction
 between enforced parent policy and repository-overridable defaults.

plugins/gh-settings/skills/sync/references/standard.md

@@ -42,10 +42,45 @@ push protection, and paid dependent features unless separately authorized. Keep
 malware alerts within their supported ecosystems and delegated dismissal disabled
 when it requires a paid product.
 
-Code Quality is separate from CodeQL and Code Security. Check its account allowance,
-repository access, and enforcement when in scope. A `No repositories` policy must
-not start scans or incur charges; leave it disabled and report a gap if GitHub
-cannot enforce that state without enablement.
+Code Quality is separate from CodeQL and Code Security. For a no-extra-cost
+profile, keep it disabled on public and private repositories. At Enterprise scope,
+verify organization access is unavailable and repository administrators cannot
+enable it. Where organization controls remain available, require `No repositories`
+with `Enforce access`; the default alone does not disable repository opt-ins.
+Read back effective repository analysis as off. Never enable the product to expose
+a hidden control or complete verification.
+
+### Prevent Additional Charges
+
+Preserve the authorized base subscription and seat allowance. The acg-box baseline
+allows one GHEC seat and no additional paid products or metered charges unless the
+user changes that profile. Keep confirmed free features. Trials, discounts,
+included quotas, and public visibility do not prove that a feature and its
+dependent Actions, storage, or AI workloads cannot incur charges.
+
+Within the authorized scope, disable unapproved paid products and use parent
+enforcement to prevent lower scopes from enabling them again. For retained metered
+services, verify a supported zero-paid-spend stop while preserving included free
+usage where supported. Report an uncovered cost risk instead of enabling a feature
+with uncertain billing to maximize security coverage.
+
+Budgets supplement product controls. Verify current product/SKU support, units,
+scope, exclusions, and stop-usage enforcement. Alert-only budgets do not cap use;
+GHEC license budgets cannot prevent additional seats. Do not assume Code Quality
+supports a budget or that a GHAS budget disables existing paid enablement. Recheck
+provider capabilities instead of treating historical API limitations as permanent.
+
+For account-wide cost audits, inspect consumed licenses and billable usage,
+including outside collaborators and invitations that can add seats. Cost control
+does not authorize removing people or repository access. Report excess seats and
+the proposed access change unless that exact change is already authorized.
+
+Verify effective product state, restrictions on re-enablement, and current-period
+net charges separately. Account for reporting delay, usage before a budget existed,
+and license charges that continue after disablement or user removal. Current
+consumed seats do not establish the period's billable seats. Report remaining
+charges and gaps; do not promise a monthly total or zero future charges from
+current settings, absent usage records, or partial-period totals alone.
 
 ### Automatic Dependency Submission
 
@@ -168,5 +203,10 @@ Use current official documentation for the controls involved:
 - [Actions permissions](https://docs.github.com/en/rest/actions/permissions); and
 - [GraphQL](https://docs.github.com/en/graphql/reference).
 
+For cost controls, consult [budgets and alerts](https://docs.github.com/en/billing/concepts/budgets-and-alerts),
+[Code Quality disablement](https://docs.github.com/en/code-security/how-tos/maintain-quality-code/disable-code-quality),
+[Enterprise Code Quality policy](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-enterprise-security/configure-specific-tools/allow-github-code-quality-in-enterprise),
+and [enterprise license billing](https://docs.github.com/en/enterprise-cloud@latest/billing/concepts/enterprise-billing/usage-based-licenses).
+
 Consult the relevant product documentation for billing, default precedence,
 attachment compatibility, and automatic dependency submission prerequisites.