authorising when ansible pull from private git repo

can you not just give them read only access?