@thcipriani and the folks on his team are probably best positioned to evaluate both the membership and rights.

I sent an email to all users with the the repository-admins ACL and asked if it's ok that I remove them.. waiting for responses to start and make the list smaller as the ticket says..

Well, we have reduced the number of admins but we have also heard from some of them that they do want to keep their admin rights.

So I would say the "Audit the users in acl*repository-admins" part is done.

Regarding acl*discovery-repository-admins I have mailed Mikhail and Erik to ask them about it now.

I checked with the 2 members in acl*discovery-repository-admins and was told it's safe to clean that up.

I removed the members from https://phabricator.wikimedia.org/project/manage/2625/ , locked it and then archived it.

• Determine if acl*discovery-repository-admins is still useful

Mentioned in SAL (#wikimedia-operations) [2023-03-06T18:38:15Z] <mutante> phabricator - locked and archived project acl*discovery-repository-admins (T324171)

@bd808 So an audit has happened and we have reduced the number of admins and archived one of the ACLs.

You were among the users who had reasons to want to keep these rights so you are aware of the special cases.

Separately one single user has said "allows me to manage global Herald rules which is something I use from time to time" so that would answer the last of the 3 check boxes. But I am going to see if we can give them those rights in a different way.

Other than that I think we can close this ticket now. Thoughts?

Global Herald rules can be managed via acl*phabricator membership. (Why do we even include Diffusion-Repository-Administrators in that ACL?)

Hi @MarcoAurelio you have said that you sometimes use the "Diffusion-Repository-Administrators" group membership to edit global Herald rules.

In https://phabricator.wikimedia.org/policy/explain/PHID-APPS-PhabricatorHeraldApplication/herald.global/ I see that it's either "be a Phab admin" or "be a repo admin" or "be in acl*phabricator" to be allow to edit global Herad rules.

You are both a repo admin and in acl*phabricator, so removing you from repo admins should not take away your rights to edit global herald rules.

But then there is still the "archive the repositories of the archived extensions" ?

Yea, so if anyone can edit https://phabricator.wikimedia.org/policy/explain/PHID-APPS-PhabricatorHeraldApplication/herald.global/ to remove "Diffusion-Repository-Administrators" from the Herald policy, please do so.

@Aklapper @brennen

In T324171#8669941, @Dzahn wrote:

Yea, so if anyone can edit to remove "Diffusion-Repository-Administrators" from the Herald policy

I went to https://phabricator.wikimedia.org/applications/edit/PhabricatorHeraldApplication/ and removed Diffusion-Repository-Administrators from Can Manage Global Rules