### Summary The [Create an issue comment](https://docs.github.com/en/rest/issues/comments#create-an-issue-comment) reference says that a GitHub App installation access token needs at least one of these permission sets: - `Issues` repository permission: `write` - `Pull requests` repository permission: `write` In a live GitHub App installation, `Issues: write` plus `Pull requests: read` was insufficient for creating a regular timeline comment on a pull request via `POST /repos/{owner}/{repo}/issues/{issue_number}/comments`. ### Reproduction 1. Install a GitHub App on one selected private repository with these repository permissions: `Contents: read`, `Pull requests: read`, `Checks: write`, `Issues: write`, and `Metadata: read`. 2. Create an installation access token. 3. `POST /repos/{owner}/{repo}/issues/{pull_number}/comments` with a normal JSON `body`. ### Expected result The request succeeds because the token has `Issues: write`, one of the two documented alternatives. ### Actual result The request returns HTTP 403. GitHub's `X-Accepted-GitHub-Permissions` response header identifies both `issues=write` and `pull_requests=write` as required. The installation token's effective permissions were `issues=write` and `pull_requests=read` (along with unrelated read/check permissions). After granting `Pull requests: write` to the same selected-repository installation, the identical application flow could create and update the PR timeline comment. Check Run publication succeeds in both permission configurations. Could you clarify whether the runtime behavior or the REST API reference is correct?