Fix WG/IG modeling gaps

README.md

@@ -2,7 +2,7 @@
 
 Infrastructure as Code for managing access to MCP community resources using Pulumi.
 
-- Define groups in [`src/config/groups.ts`](src/config/groups.ts)
+- Define groups in [`src/config/roles.ts`](src/config/roles.ts)
 - Add users to groups in [`src/config/users.ts`](src/config/users.ts)
 - Changes are applied via GitHub Actions when merged to the main branch
 

src/config/repoAccess.ts

@@ -34,7 +34,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -63,7 +63,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -90,7 +90,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -122,7 +122,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'triage' },
       { team: 'rust-sdk', permission: 'triage' },
       { team: 'sdk-maintainers', permission: 'triage' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'triage' },
       { team: 'swift-sdk', permission: 'triage' },
       { team: 'transport-wg', permission: 'triage' },
@@ -151,7 +151,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -179,7 +179,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'ruby-sdk', permission: 'push' },
       { team: 'rust-sdk', permission: 'push' },
       { team: 'sdk-maintainers', permission: 'push' },
-      { team: 'security-wg', permission: 'admin' },
+      { team: 'security-ig', permission: 'admin' },
       { team: 'steering-committee', permission: 'push' },
       { team: 'swift-sdk', permission: 'push' },
       { team: 'transport-wg', permission: 'push' },
@@ -342,7 +342,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     teams: [
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'moderators', permission: 'maintain' },
-      { team: 'skills-over-mcp-ig', permission: 'admin' },
+      { team: 'skills-over-mcp-wg', permission: 'admin' },
     ],
   },
   {

src/config/roleIds.ts

@@ -51,27 +51,28 @@ export const ROLE_IDS = {
   // ===================
   WORKING_GROUPS: 'working-groups',
   AUTH_MAINTAINERS: 'auth-maintainers',
-  SECURITY_WG: 'security-wg',
-  SERVER_IDENTITY_WG: 'server-identity-wg',
+  AUTH_TOOL_SCOPES_WG: 'auth-wg-tool-scopes',
+  AUTH_FINE_GRAINED_AUTHZ_WG: 'auth-wg-fine-grained-authz',
   TRANSPORT_WG: 'transport-wg',
   TRIGGERS_EVENTS_WG: 'triggers-events-wg',
   MCP_APPS_WG: 'mcp-apps-wg',
   SERVER_CARD_WG: 'server-card-wg',
   INTERCEPTORS_WG: 'interceptors-wg',
   FILE_UPLOADS_WG: 'file-uploads-wg',
   AGENTS_WG: 'agents-wg',
+  SKILLS_OVER_MCP_WG: 'skills-over-mcp-wg',
 
   // ===================
   // Interest Groups
   // ===================
   INTEREST_GROUPS: 'interest-groups',
-  AGENTS_IG: 'agents-ig',
   AUTH_IG: 'auth-ig',
   CLIENT_IMPLEMENTOR_IG: 'client-implementor-ig',
+  ENTERPRISE_MANAGED_AUTHORIZATION_IG: 'enterprise-managed-authorization-ig',
   FINANCIAL_SERVICES_IG: 'financial-services-ig',
   GATEWAYS_IG: 'gateways-ig',
   PRIMITIVE_GROUPING_IG: 'primitive-grouping-ig',
-  SKILLS_OVER_MCP_IG: 'skills-over-mcp-ig',
+  SECURITY_IG: 'security-ig',
   TOOL_ANNOTATIONS_IG: 'tool-annotations-ig',
 
   // ===================

src/config/roles.ts

@@ -299,17 +299,16 @@ export const ROLES: readonly Role[] = [
     // See AUTH_IG for Discord role
   },
   {
-    id: ROLE_IDS.SECURITY_WG,
-    description: 'Security Working Group',
-    github: { team: 'security-wg', parent: ROLE_IDS.WORKING_GROUPS },
-    // See interest group for Discord role
+    id: ROLE_IDS.AUTH_TOOL_SCOPES_WG,
+    description: 'Auth Tool Scopes Working Group',
+    github: { team: 'auth-wg-tool-scopes', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'auth tool scopes working group (synced)' },
   },
   {
-    id: ROLE_IDS.SERVER_IDENTITY_WG,
-    description: 'Server Identity Working Group',
-    discord: { role: 'server identity working group (synced)' },
-    // Discord only for now - no github.parent link to WORKING_GROUPS, so flag directly
-    provisionUser: true,
+    id: ROLE_IDS.AUTH_FINE_GRAINED_AUTHZ_WG,
+    description: 'Auth Fine-Grained Authorization Working Group',
+    github: { team: 'auth-wg-fine-grained-authz', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'auth fine-grained authorization working group (synced)' },
   },
   {
     id: ROLE_IDS.TRANSPORT_WG,
@@ -351,6 +350,13 @@ export const ROLES: readonly Role[] = [
     id: ROLE_IDS.AGENTS_WG,
     description: 'Agents Working Group',
     github: { team: 'agents-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'agents working group (synced)' },
+  },
+  {
+    id: ROLE_IDS.SKILLS_OVER_MCP_WG,
+    description: 'Skills Over MCP Working Group',
+    github: { team: 'skills-over-mcp-wg', parent: ROLE_IDS.WORKING_GROUPS },
+    discord: { role: 'skills over mcp working group (synced)' },
   },
 
   // ===================
@@ -362,12 +368,6 @@ export const ROLES: readonly Role[] = [
     github: { team: 'interest-groups', parent: ROLE_IDS.STEERING_COMMITTEE },
     // No discord - organizational container
   },
-  {
-    id: ROLE_IDS.AGENTS_IG,
-    description: 'Agents Interest Group',
-    discord: { role: 'agents interest group (synced)' },
-    // Discord only
-  },
   {
     id: ROLE_IDS.AUTH_IG,
     description: 'Auth Interest Group',
@@ -380,6 +380,12 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'client implementor interest group (synced)' },
     // Discord only
   },
+  {
+    id: ROLE_IDS.ENTERPRISE_MANAGED_AUTHORIZATION_IG,
+    description: 'Enterprise-Managed Authorization Interest Group',
+    discord: { role: 'enterprise-managed authorization interest group (synced)' },
+    // Discord only
+  },
   {
     id: ROLE_IDS.FINANCIAL_SERVICES_IG,
     description: 'Financial Services Interest Group',
@@ -399,10 +405,10 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'primitive grouping interest group (synced)' },
   },
   {
-    id: ROLE_IDS.SKILLS_OVER_MCP_IG,
-    description: 'Skills Over MCP Interest Group',
-    github: { team: 'skills-over-mcp-ig', parent: ROLE_IDS.INTEREST_GROUPS },
-    discord: { role: 'skills over mcp interest group (synced)' },
+    id: ROLE_IDS.SECURITY_IG,
+    description: 'Security Interest Group',
+    github: { team: 'security-ig', parent: ROLE_IDS.INTEREST_GROUPS },
+    // No synced Discord role yet, see the #security-ig channel
   },
   {
     id: ROLE_IDS.TOOL_ANNOTATIONS_IG,