Maintainer status is tested, not assumed
Scope layering
Before the other sections apply, the file defines how to establish which scope the agent is in. Maintainer status requires three conditions together: the username appears in a checked-in file, the configured remote is the canonical repository, and the authenticated account has write access. Any condition that cannot be verified sends the agent to the most restricted scope.
