Fix WG/IG modeling gaps (#170)

Add the enterprise-managed-authorization IG, the two active auth
sub-WGs (tool scopes and fine-grained authorization), an agents WG
Discord role, and auth IG memberships from the charter. Convert
skills-over-mcp from IG to WG and security from WG to IG per their
charters, updating team names and all references. Add ochafik to the
MCP Apps WG and pcarleton to the security IG. Remove the
server-identity-wg and agents-ig roles, whose Discord channels are
archived or gone. Fix the README link to src/config/roles.ts.


Claude-Session: https://claude.ai/code/session_01VRxNJh9HqnkTYdpALP5Vhf

Co-authored-by: Claude <noreply@anthropic.com>

README.md

@@ -2,7 +2,7 @@
 
 Infrastructure as Code for managing access to MCP community resources using Pulumi.
 
-- Define groups in [`src/config/groups.ts`](src/config/groups.ts)
+- Define groups in [`src/config/roles.ts`](src/config/roles.ts)
 - Add users to groups in [`src/config/users.ts`](src/config/users.ts)
 - Changes are applied via GitHub Actions when merged to the main branch
 

src/config/repoAccess.ts

@@ -34,7 +34,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -63,7 +63,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -90,7 +90,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -122,7 +122,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -151,7 +151,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -179,7 +179,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -342,7 +342,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     teams: [
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'moderators', permission: 'maintain' },
-      { team: 'skills-over-mcp-ig', permission: 'admin' },
+      { team: 'skills-over-mcp-wg', permission: 'admin' },
     ],
   },
   {

src/config/roleIds.ts

@@ -51,8 +51,8 @@ export const ROLE_IDS = {
   // ===================
   WORKING_GROUPS: 'working-groups',
   AUTH_MAINTAINERS: 'auth-maintainers',
-  SECURITY_WG: 'security-wg',
+  AUTH_TOOL_SCOPES_WG: 'auth-wg-tool-scopes',
-  SERVER_IDENTITY_WG: 'server-identity-wg',
+  AUTH_FINE_GRAINED_AUTHZ_WG: 'auth-wg-fine-grained-authz',
   TRANSPORT_WG: 'transport-wg',
   TRIGGERS_EVENTS_WG: 'triggers-events-wg',
   MCP_APPS_WG: 'mcp-apps-wg',
@@ -60,18 +60,19 @@ export const ROLE_IDS = {
   INTERCEPTORS_WG: 'interceptors-wg',
   FILE_UPLOADS_WG: 'file-uploads-wg',
   AGENTS_WG: 'agents-wg',
+  SKILLS_OVER_MCP_WG: 'skills-over-mcp-wg',
 
   // ===================
   // Interest Groups
   // ===================
   INTEREST_GROUPS: 'interest-groups',
-  AGENTS_IG: 'agents-ig',
   AUTH_IG: 'auth-ig',
   CLIENT_IMPLEMENTOR_IG: 'client-implementor-ig',
+  ENTERPRISE_MANAGED_AUTHORIZATION_IG: 'enterprise-managed-authorization-ig',
   FINANCIAL_SERVICES_IG: 'financial-services-ig',
   GATEWAYS_IG: 'gateways-ig',
   PRIMITIVE_GROUPING_IG: 'primitive-grouping-ig',
-  SKILLS_OVER_MCP_IG: 'skills-over-mcp-ig',
+  SECURITY_IG: 'security-ig',
   TOOL_ANNOTATIONS_IG: 'tool-annotations-ig',
 
   // ===================

src/config/roles.ts

@@ -299,17 +299,16 @@ export const ROLES: readonly Role[] = [
     // See AUTH_IG for Discord role
   },
   {
-    id: ROLE_IDS.SECURITY_WG,
+    id: ROLE_IDS.AUTH_TOOL_SCOPES_WG,
-    description: 'Security Working Group',
+    description: 'Auth Tool Scopes Working Group',
-    github: { team: 'security-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    github: { team: 'auth-wg-tool-scopes', parent: ROLE_IDS.WORKING_GROUPS },
-    // See interest group for Discord role
+    discord: { role: 'auth tool scopes working group (synced)' },
   },
   {
-    id: ROLE_IDS.SERVER_IDENTITY_WG,
+    id: ROLE_IDS.AUTH_FINE_GRAINED_AUTHZ_WG,
-    description: 'Server Identity Working Group',
+    description: 'Auth Fine-Grained Authorization Working Group',
-    discord: { role: 'server identity working group (synced)' },
+    github: { team: 'auth-wg-fine-grained-authz', parent: ROLE_IDS.WORKING_GROUPS },
-    // Discord only for now - no github.parent link to WORKING_GROUPS, so flag directly
+    discord: { role: 'auth fine-grained authorization working group (synced)' },
-    provisionUser: true,
   },
   {
     id: ROLE_IDS.TRANSPORT_WG,
@@ -351,6 +350,13 @@ export const ROLES: readonly Role[] = [
     id: ROLE_IDS.AGENTS_WG,
     description: 'Agents Working Group',
     github: { team: 'agents-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'agents working group (synced)' },
+  },
+  {
+    id: ROLE_IDS.SKILLS_OVER_MCP_WG,
+    description: 'Skills Over MCP Working Group',
+    github: { team: 'skills-over-mcp-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'skills over mcp working group (synced)' },
   },
 
   // ===================
@@ -362,12 +368,6 @@ export const ROLES: readonly Role[] = [
     github: { team: 'interest-groups', parent: ROLE_IDS.STEERING_COMMITTEE },
     // No discord - organizational container
   },
-  {
-    id: ROLE_IDS.AGENTS_IG,
-    description: 'Agents Interest Group',
-    discord: { role: 'agents interest group (synced)' },
-    // Discord only
-  },
   {
     id: ROLE_IDS.AUTH_IG,
     description: 'Auth Interest Group',
@@ -380,6 +380,12 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'client implementor interest group (synced)' },
     // Discord only
   },
+  {
+    id: ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+    description: 'Enterprise-Managed Authorization Interest Group',
+    discord: { role: 'enterprise-managed authorization interest group (synced)' },
+    // Discord only
+  },
   {
     id: ROLE_IDS.FINANCIAL_SERVICES_IG,
     description: 'Financial Services Interest Group',
@@ -399,10 +405,10 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'primitive grouping interest group (synced)' },
   },
   {
-    id: ROLE_IDS.SKILLS_OVER_MCP_IG,
+    id: ROLE_IDS.SECURITY_IG,
-    description: 'Skills Over MCP Interest Group',
+    description: 'Security Interest Group',
-    github: { team: 'skills-over-mcp-ig', parent: ROLE_IDS.INTEREST_GROUPS },
+    github: { team: 'security-ig', parent: ROLE_IDS.INTEREST_GROUPS },
-    discord: { role: 'skills over mcp interest group (synced)' },
+    // No synced Discord role yet, see the #security-ig channel
   },
   {
     id: ROLE_IDS.TOOL_ANNOTATIONS_IG,

src/config/users.ts

@@ -22,7 +22,12 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'aaronpk',
     discord: '324624369428987905',
-    memberOf: [ROLE_IDS.AUTH_MAINTAINERS, ROLE_IDS.MAINTAINERS],
+    memberOf: [
+      ROLE_IDS.AUTH_MAINTAINERS,
+      ROLE_IDS.AUTH_IG,
+      ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+      ROLE_IDS.MAINTAINERS,
+    ],
     firstName: 'Aaron',
     lastName: 'Parecki',
     googleEmailPrefix: 'aaronpk',
@@ -30,7 +35,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'aditya-scio',
     discord: '1196052678925631498',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'ajribeiro',
@@ -50,7 +55,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'an-dustin',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'antonpk1',
@@ -163,7 +168,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.PRIMITIVE_GROUPING_IG,
       ROLE_IDS.REFERENCE_SERVERS_MAINTAINERS,
       ROLE_IDS.MODERATORS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.WORKING_GROUPS,
       ROLE_IDS.APPEALS,
     ],
@@ -180,7 +185,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'D-McAdams',
     discord: '1364696680980545697',
-    memberOf: [ROLE_IDS.AUTH_MAINTAINERS],
+    memberOf: [ROLE_IDS.AUTH_MAINTAINERS, ROLE_IDS.AUTH_IG],
   },
   {
     github: 'daleseo',
@@ -220,7 +225,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
@@ -253,7 +258,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
@@ -296,7 +301,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'erain',
     discord: '797226095874539539',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'evalstate',
@@ -331,7 +336,7 @@ export const MEMBERS: readonly Member[] = [
     memberOf: [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
   },
@@ -380,7 +385,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'JAORMX',
     discord: '1185152774674055193',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'jba',
@@ -395,7 +400,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'jenn-newton',
-    memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'jeongukjae',
@@ -449,7 +454,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'kaxil',
     discord: '757355088946921474',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'Kehrlann',
@@ -462,7 +467,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'keithagroves',
     discord: '321019863260987392',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'KKonstantinov',
@@ -522,7 +527,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
       ROLE_IDS.APPEALS,
@@ -534,12 +539,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Luca',
     lastName: 'Chang',
     googleEmailPrefix: 'luca',
-    memberOf: [
+    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.AGENTS_WG, ROLE_IDS.WORKING_GROUPS],
-      ROLE_IDS.MAINTAINERS,
-      ROLE_IDS.AGENTS_IG,
-      ROLE_IDS.AGENTS_WG,
-      ROLE_IDS.WORKING_GROUPS,
-    ],
   },
   {
     github: 'maciej-kisiel',
@@ -612,7 +612,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Nick',
     lastName: 'Cooper',
     googleEmailPrefix: 'nickc',
-    memberOf: [ROLE_IDS.CORE_MAINTAINERS, ROLE_IDS.FILE_UPLOADS_WG, ROLE_IDS.SERVER_IDENTITY_WG],
+    memberOf: [ROLE_IDS.CORE_MAINTAINERS, ROLE_IDS.FILE_UPLOADS_WG],
   },
   {
     github: 'nicolas-grekas',
@@ -633,6 +633,7 @@ export const MEMBERS: readonly Member[] = [
     existingGWSUser: true,
     memberOf: [
       ROLE_IDS.FILE_UPLOADS_WG,
+      ROLE_IDS.MCP_APPS_WG,
       ROLE_IDS.MCP_APPS_SDK,
       ROLE_IDS.PYTHON_SDK,
       ROLE_IDS.PYTHON_SDK_AUTH,
@@ -642,7 +643,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'og-ant',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'olaservo',
@@ -658,7 +659,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.MODERATORS,
       ROLE_IDS.REFERENCE_SERVERS_MAINTAINERS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.WORKING_GROUPS,
       ROLE_IDS.APPEALS,
     ],
@@ -685,6 +686,9 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.TYPESCRIPT_SDK,
       ROLE_IDS.TYPESCRIPT_SDK_AUTH,
       ROLE_IDS.AUTH_MAINTAINERS,
+      ROLE_IDS.AUTH_IG,
+      ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+      ROLE_IDS.SECURITY_IG,
     ],
   },
   {
@@ -698,14 +702,14 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.FINANCIAL_SERVICES_IG,
       ROLE_IDS.MODERATORS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.INTERCEPTORS_WG,
       ROLE_IDS.APPEALS,
     ],
   },
   {
     github: 'petery-ant',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'pja-ant',
@@ -717,7 +721,7 @@ export const MEMBERS: readonly Member[] = [
     memberOf: [
       ROLE_IDS.CORE_MAINTAINERS,
       ROLE_IDS.MAINTAINERS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TRIGGERS_EVENTS_WG,
       ROLE_IDS.AGENTS_WG,
@@ -758,7 +762,7 @@ export const MEMBERS: readonly Member[] = [
     lastName: 'Dimitrov',
     googleEmailPrefix: 'radoslav',
     existingGWSUser: true,
-    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.REGISTRY_MAINTAINERS, ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.REGISTRY_MAINTAINERS, ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'rreichel3',
@@ -776,7 +780,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.FINANCIAL_SERVICES_IG,
       ROLE_IDS.INTERCEPTORS_WG,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
     ],
   },
   {
@@ -790,7 +794,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.PRIMITIVE_GROUPING_IG,
       ROLE_IDS.SERVER_CARD_WG,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.TOOL_ANNOTATIONS_IG,
       ROLE_IDS.WG_IG_FACILITATORS,
     ],
@@ -819,7 +823,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'sunishsheth2009',
     discord: '1414713222224941097',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'tadasant',