Thanks @Ottomata. Ftr, I approve the proposal.

@Ottomata I'm just removing the SRE-Access-Requests tag to remove this from the Clinic Duty dashboard.

This sounds sensible to me, too.
Given that we have approval for the proposal as it stands, how do we proceed?

Do we just need to update the guidelines on Wikitech?

Should we still retain the list of approvers, for when nda or other non-staff members might request access?

That and maybe some comments in puppet admin data.yaml to instruct SREs on the right thing to do?

Change #1082826 had a related patch set uploaded (by Ottomata; author: Ottomata):

[operations/puppet@production] admin data.yaml - explicit approval is not needed for analytics-privatedata-users

https://gerrit.wikimedia.org/r/1082826

Updated docs:
https://wikitech.wikimedia.org/w/index.php?title=SRE%2FProduction_access&diff=2238869&oldid=2235497

Submitted patch with comment in admin data.yaml puppet:
https://gerrit.wikimedia.org/r/c/operations/puppet/+/1082826/1/modules/admin/data/data.yaml#459

In T370424#10051517, @BTullis wrote:

This sounds sensible to me, too.
Given that we have approval for the proposal as it stands, how do we proceed?

Do we just need to update the guidelines on Wikitech?

Should we still retain the list of approvers, for when nda or other non-staff members might request access?

For now updating wikitech and a comment in data.yaml are fine. Mid-term the approval management will move to Bitu/idm.wikimedia.org and there is already support for auto-approvals based on prior conditions (such has "has a @wikimedia.org address" and "has active NDA")

What's the rationale for treating non-staff different? Is it intentional? If they have signed the necessary NDAs (which is validated independently anyway), why does that still need explicit approval as opposed to staff.

Historically this approval step was introduced because there was a case where someone ran a very heavy Hadoop query which had impact on other users of the cluster. And the approval was introduced to make sure that new Hadoop users familiarise themselves with the constraints of running queries. But I'd expect that for non-staff (let's say a researcher working with an existing staff analyst), the same introduction would happen anyway?

Mid-term the approval management will move to Bitu/idm.wikimedia.org

COOL!

What's the rationale for treating non-staff different?

Good question. I think it was just easier to justify non approval for staff. There are more staff asking for approval and we always just auto approve, so it made sense to streamline. Non staff requests are less frequent, and I kind of like knowing about non staff that get access.

You are right though/ I don't think there are any safety reasons to need approval for non staff, and tagging Data-Engineering in the phab request should be sufficient for notification.

Change #1082826 merged by Ottomata:

[operations/puppet@production] admin - explicit approval not needed for analytics-privatedata-users

https://gerrit.wikimedia.org/r/1082826

Merged!

Also updated docs here:
https://wikitech.wikimedia.org/w/index.php?title=SRE%2FClinic_Duty%2FAccess_requests&diff=2239783&oldid=2224064

See T381824 for potentially extending the same streamlining to WMDE staff.