One thing I noticed: Using the GitHub UI, I added a collaborator to a repository. I saw that they committed changes without any authority / approval from me. It was a private repository.
With private repositories, how do I give someone read access versus write access?