diff --git a/README.md b/README.md
index 030c7ee..a8d219f 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Infrastructure as Code for managing access to MCP community resources using Pulumi.
 
-- Define groups in [`src/config/groups.ts`](src/config/groups.ts)
+- Define groups in [`src/config/roles.ts`](src/config/roles.ts)
 - Add users to groups in [`src/config/users.ts`](src/config/users.ts)
 - Changes are applied via GitHub Actions when merged to the main branch
 
diff --git a/src/config/repoAccess.ts b/src/config/repoAccess.ts
index 998f7ce..7fe8835 100644
--- a/src/config/repoAccess.ts
+++ b/src/config/repoAccess.ts
@@ -34,7 +34,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -63,7 +63,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -90,7 +90,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -122,7 +122,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -151,7 +151,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -179,7 +179,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -342,7 +342,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     teams: [
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'moderators', permission: 'maintain' },
-      { team: 'skills-over-mcp-ig', permission: 'admin' },
+      { team: 'skills-over-mcp-wg', permission: 'admin' },
     ],
   },
   {
diff --git a/src/config/roleIds.ts b/src/config/roleIds.ts
index bc5ec77..84635a3 100644
--- a/src/config/roleIds.ts
+++ b/src/config/roleIds.ts
@@ -51,8 +51,8 @@ export const ROLE_IDS = {
   // ===================
   WORKING_GROUPS: 'working-groups',
   AUTH_MAINTAINERS: 'auth-maintainers',
-  SECURITY_WG: 'security-wg',
-  SERVER_IDENTITY_WG: 'server-identity-wg',
+  AUTH_TOOL_SCOPES_WG: 'auth-wg-tool-scopes',
+  AUTH_FINE_GRAINED_AUTHZ_WG: 'auth-wg-fine-grained-authz',
   TRANSPORT_WG: 'transport-wg',
   TRIGGERS_EVENTS_WG: 'triggers-events-wg',
   MCP_APPS_WG: 'mcp-apps-wg',
@@ -60,18 +60,19 @@ export const ROLE_IDS = {
   INTERCEPTORS_WG: 'interceptors-wg',
   FILE_UPLOADS_WG: 'file-uploads-wg',
   AGENTS_WG: 'agents-wg',
+  SKILLS_OVER_MCP_WG: 'skills-over-mcp-wg',
 
   // ===================
   // Interest Groups
   // ===================
   INTEREST_GROUPS: 'interest-groups',
-  AGENTS_IG: 'agents-ig',
   AUTH_IG: 'auth-ig',
   CLIENT_IMPLEMENTOR_IG: 'client-implementor-ig',
+  ENTERPRISE_MANAGED_AUTHORIZATION_IG: 'enterprise-managed-authorization-ig',
   FINANCIAL_SERVICES_IG: 'financial-services-ig',
   GATEWAYS_IG: 'gateways-ig',
   PRIMITIVE_GROUPING_IG: 'primitive-grouping-ig',
-  SKILLS_OVER_MCP_IG: 'skills-over-mcp-ig',
+  SECURITY_IG: 'security-ig',
   TOOL_ANNOTATIONS_IG: 'tool-annotations-ig',
 
   // ===================
diff --git a/src/config/roles.ts b/src/config/roles.ts
index e2147ad..15f51cc 100644
--- a/src/config/roles.ts
+++ b/src/config/roles.ts
@@ -299,17 +299,16 @@ export const ROLES: readonly Role[] = [
     // See AUTH_IG for Discord role
   },
   {
-    id: ROLE_IDS.SECURITY_WG,
-    description: 'Security Working Group',
-    github: { team: 'security-wg', parent: ROLE_IDS.WORKING_GROUPS },
-    // See interest group for Discord role
+    id: ROLE_IDS.AUTH_TOOL_SCOPES_WG,
+    description: 'Auth Tool Scopes Working Group',
+    github: { team: 'auth-wg-tool-scopes', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'auth tool scopes working group (synced)' },
   },
   {
-    id: ROLE_IDS.SERVER_IDENTITY_WG,
-    description: 'Server Identity Working Group',
-    discord: { role: 'server identity working group (synced)' },
-    // Discord only for now - no github.parent link to WORKING_GROUPS, so flag directly
-    provisionUser: true,
+    id: ROLE_IDS.AUTH_FINE_GRAINED_AUTHZ_WG,
+    description: 'Auth Fine-Grained Authorization Working Group',
+    github: { team: 'auth-wg-fine-grained-authz', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'auth fine-grained authorization working group (synced)' },
   },
   {
     id: ROLE_IDS.TRANSPORT_WG,
@@ -351,6 +350,13 @@ export const ROLES: readonly Role[] = [
     id: ROLE_IDS.AGENTS_WG,
     description: 'Agents Working Group',
     github: { team: 'agents-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'agents working group (synced)' },
+  },
+  {
+    id: ROLE_IDS.SKILLS_OVER_MCP_WG,
+    description: 'Skills Over MCP Working Group',
+    github: { team: 'skills-over-mcp-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'skills over mcp working group (synced)' },
   },
 
   // ===================
@@ -362,12 +368,6 @@ export const ROLES: readonly Role[] = [
     github: { team: 'interest-groups', parent: ROLE_IDS.STEERING_COMMITTEE },
     // No discord - organizational container
   },
-  {
-    id: ROLE_IDS.AGENTS_IG,
-    description: 'Agents Interest Group',
-    discord: { role: 'agents interest group (synced)' },
-    // Discord only
-  },
   {
     id: ROLE_IDS.AUTH_IG,
     description: 'Auth Interest Group',
@@ -380,6 +380,12 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'client implementor interest group (synced)' },
     // Discord only
   },
+  {
+    id: ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+    description: 'Enterprise-Managed Authorization Interest Group',
+    discord: { role: 'enterprise-managed authorization interest group (synced)' },
+    // Discord only
+  },
   {
     id: ROLE_IDS.FINANCIAL_SERVICES_IG,
     description: 'Financial Services Interest Group',
@@ -399,10 +405,10 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'primitive grouping interest group (synced)' },
   },
   {
-    id: ROLE_IDS.SKILLS_OVER_MCP_IG,
-    description: 'Skills Over MCP Interest Group',
-    github: { team: 'skills-over-mcp-ig', parent: ROLE_IDS.INTEREST_GROUPS },
-    discord: { role: 'skills over mcp interest group (synced)' },
+    id: ROLE_IDS.SECURITY_IG,
+    description: 'Security Interest Group',
+    github: { team: 'security-ig', parent: ROLE_IDS.INTEREST_GROUPS },
+    // No synced Discord role yet, see the #security-ig channel
   },
   {
     id: ROLE_IDS.TOOL_ANNOTATIONS_IG,
diff --git a/src/config/users.ts b/src/config/users.ts
index ebd8be4..4c527ad 100644
--- a/src/config/users.ts
+++ b/src/config/users.ts
@@ -22,7 +22,12 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'aaronpk',
     discord: '324624369428987905',
-    memberOf: [ROLE_IDS.AUTH_MAINTAINERS, ROLE_IDS.MAINTAINERS],
+    memberOf: [
+      ROLE_IDS.AUTH_MAINTAINERS,
+      ROLE_IDS.AUTH_IG,
+      ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+      ROLE_IDS.MAINTAINERS,
+    ],
     firstName: 'Aaron',
     lastName: 'Parecki',
     googleEmailPrefix: 'aaronpk',
@@ -30,7 +35,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'aditya-scio',
     discord: '1196052678925631498',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'ajribeiro',
@@ -50,7 +55,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'an-dustin',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'antonpk1',
@@ -163,7 +168,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.PRIMITIVE_GROUPING_IG,
       ROLE_IDS.REFERENCE_SERVERS_MAINTAINERS,
       ROLE_IDS.MODERATORS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.WORKING_GROUPS,
       ROLE_IDS.APPEALS,
     ],
@@ -180,7 +185,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'D-McAdams',
     discord: '1364696680980545697',
-    memberOf: [ROLE_IDS.AUTH_MAINTAINERS],
+    memberOf: [ROLE_IDS.AUTH_MAINTAINERS, ROLE_IDS.AUTH_IG],
   },
   {
     github: 'daleseo',
@@ -220,7 +225,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
@@ -253,7 +258,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
@@ -296,7 +301,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'erain',
     discord: '797226095874539539',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'evalstate',
@@ -331,7 +336,7 @@ export const MEMBERS: readonly Member[] = [
     memberOf: [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TYPESCRIPT_SDK,
     ],
   },
@@ -380,7 +385,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'JAORMX',
     discord: '1185152774674055193',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'jba',
@@ -395,7 +400,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'jenn-newton',
-    memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'jeongukjae',
@@ -449,7 +454,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'kaxil',
     discord: '757355088946921474',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'Kehrlann',
@@ -462,7 +467,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'keithagroves',
     discord: '321019863260987392',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'KKonstantinov',
@@ -522,7 +527,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MODERATORS,
       ROLE_IDS.PHP_SDK,
       ROLE_IDS.PYTHON_SDK,
-      ROLE_IDS.SECURITY_WG,
+      ROLE_IDS.SECURITY_IG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TYPESCRIPT_SDK,
       ROLE_IDS.APPEALS,
@@ -534,12 +539,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Luca',
     lastName: 'Chang',
     googleEmailPrefix: 'luca',
-    memberOf: [
-      ROLE_IDS.MAINTAINERS,
-      ROLE_IDS.AGENTS_IG,
-      ROLE_IDS.AGENTS_WG,
-      ROLE_IDS.WORKING_GROUPS,
-    ],
+    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.AGENTS_WG, ROLE_IDS.WORKING_GROUPS],
   },
   {
     github: 'maciej-kisiel',
@@ -612,7 +612,7 @@ export const MEMBERS: readonly Member[] = [
     firstName: 'Nick',
     lastName: 'Cooper',
     googleEmailPrefix: 'nickc',
-    memberOf: [ROLE_IDS.CORE_MAINTAINERS, ROLE_IDS.FILE_UPLOADS_WG, ROLE_IDS.SERVER_IDENTITY_WG],
+    memberOf: [ROLE_IDS.CORE_MAINTAINERS, ROLE_IDS.FILE_UPLOADS_WG],
   },
   {
     github: 'nicolas-grekas',
@@ -633,6 +633,7 @@ export const MEMBERS: readonly Member[] = [
     existingGWSUser: true,
     memberOf: [
       ROLE_IDS.FILE_UPLOADS_WG,
+      ROLE_IDS.MCP_APPS_WG,
       ROLE_IDS.MCP_APPS_SDK,
       ROLE_IDS.PYTHON_SDK,
       ROLE_IDS.PYTHON_SDK_AUTH,
@@ -642,7 +643,7 @@ export const MEMBERS: readonly Member[] = [
   },
   {
     github: 'og-ant',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'olaservo',
@@ -658,7 +659,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.MODERATORS,
       ROLE_IDS.REFERENCE_SERVERS_MAINTAINERS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.WORKING_GROUPS,
       ROLE_IDS.APPEALS,
     ],
@@ -685,6 +686,9 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.TYPESCRIPT_SDK,
       ROLE_IDS.TYPESCRIPT_SDK_AUTH,
       ROLE_IDS.AUTH_MAINTAINERS,
+      ROLE_IDS.AUTH_IG,
+      ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+      ROLE_IDS.SECURITY_IG,
     ],
   },
   {
@@ -698,14 +702,14 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.FINANCIAL_SERVICES_IG,
       ROLE_IDS.MODERATORS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.INTERCEPTORS_WG,
       ROLE_IDS.APPEALS,
     ],
   },
   {
     github: 'petery-ant',
-    memberOf: [ROLE_IDS.SECURITY_WG],
+    memberOf: [ROLE_IDS.SECURITY_IG],
   },
   {
     github: 'pja-ant',
@@ -717,7 +721,7 @@ export const MEMBERS: readonly Member[] = [
     memberOf: [
       ROLE_IDS.CORE_MAINTAINERS,
       ROLE_IDS.MAINTAINERS,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.TRANSPORT_WG,
       ROLE_IDS.TRIGGERS_EVENTS_WG,
       ROLE_IDS.AGENTS_WG,
@@ -758,7 +762,7 @@ export const MEMBERS: readonly Member[] = [
     lastName: 'Dimitrov',
     googleEmailPrefix: 'radoslav',
     existingGWSUser: true,
-    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.REGISTRY_MAINTAINERS, ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.REGISTRY_MAINTAINERS, ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'rreichel3',
@@ -776,7 +780,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.FINANCIAL_SERVICES_IG,
       ROLE_IDS.INTERCEPTORS_WG,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
     ],
   },
   {
@@ -790,7 +794,7 @@ export const MEMBERS: readonly Member[] = [
       ROLE_IDS.MAINTAINERS,
       ROLE_IDS.PRIMITIVE_GROUPING_IG,
       ROLE_IDS.SERVER_CARD_WG,
-      ROLE_IDS.SKILLS_OVER_MCP_IG,
+      ROLE_IDS.SKILLS_OVER_MCP_WG,
       ROLE_IDS.TOOL_ANNOTATIONS_IG,
       ROLE_IDS.WG_IG_FACILITATORS,
     ],
@@ -819,7 +823,7 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'sunishsheth2009',
     discord: '1414713222224941097',
-    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_IG],
+    memberOf: [ROLE_IDS.SKILLS_OVER_MCP_WG],
   },
   {
     github: 'tadasant',