Giving someone else access to your organisation's private repo is not a small thing in my opinion.