Do you set default permissions for all new repositories?

Using GitHub Webhooks, you can set some default permissions for every new repository inside an organisation.

You can use the repository event to trigger a GitHub action to set the permissions.

See the GitHub docs Permissions API

By adding this to your organisation, every new repo will already have the optimal permissions and privileges.