Expand access control

Why is this change being made?

Adding to the control to cover private customer repos and examples of sensitive projects. This will satisfy remediation for IAM.6.01

Does this MR meet the acceptance criteria?

Conformity

• Added description to this MR explaining the reasons for the proposed change, per say-why-not-just-what